Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
57 views

How to detect fileless kernel compromise in linux

Is there a way to detect fileless kernel compromise in Linux? The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
2
votes
1answer
1k views

linux kernel security module smack transmutation example

In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
1
vote
2answers
230 views

Can a running kernel be protected by underlying rings, BIOS etc?

I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME. But are there known examples where stuff runs underneath the kernel and can be used to ...
0
votes
1answer
188 views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
2
votes
1answer
950 views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
1
vote
0answers
55 views

ctf kernel challenges does not work [closed]

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...
1
vote
0answers
32 views

Can XIP (execute in place) be used for kernel protection?

Starting with kernel 5.13 RiscV will get XIP where parts of the kernel run from non volatile memory like flash. In theory you could make parts of the kernel really read only either from the hardware ...
0
votes
1answer
108 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
3
votes
0answers
107 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
2
votes
2answers
1k views

How protected mode in CPU is really implemented?

I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
26
votes
1answer
4k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
3
votes
1answer
900 views

Dirtycow runs (lib-c to root) fine but crashes on reboot

I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
0
votes
1answer
52 views

Vulnerability in which part of the Android architecture would allow an attacker to take control of the hardware [closed]

This question is intended for better understanding of security features of Android architecture. In particular, I want to know what part of the architecture needs to be secure to prevent an attacker ...
1
vote
0answers
44 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
0
votes
2answers
94 views

Does a (kernel) exploit always need to use system calls?

It was mentioned in this thread that kernel exploits usually use syscalls to trigger undesired behavior: How can you detect kernel exploits? Are there any ways or known examples which do not use ...
2
votes
1answer
326 views

Is it necessary to understand Linux kernel internals to do binary exploitation? [closed]

I am second-year CS student, I know C, OOP concepts, x86 architecture, reverse engineering basics, TCP/IP stack and OS concepts, also I love Linux OS. I have just one question: Is it a mandatory to ...
1
vote
1answer
79 views

Vulnerabilities for multiple kernel versions that are installed on a given server

As per Exclude or display vulnerabilities for non-running Linux kernels : It is possible to have multiple kernels detected on a single Linux host and Qualys will report all vulnerabilities found on ...
0
votes
1answer
66 views

Assigning memory address of shellcode to buffer (for buffer overflow input)

I am attempting to exploit HEVD kernel driver buffer overflow challenge: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver However when running the below code my windows 7 machine doesn't ...
2
votes
2answers
73 views

Is it possible to determinate which functions a kernel module calls?

Trusting kernel drivers is bad. Is there something we can do to have at least an idea about what it does? For example, let's suppose an armv8a linux kernel. I'd search for all the syscalls, which ...
1
vote
1answer
207 views

What are the dangers of a firmware malware in 2021 and is it possible?

I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry ...
5
votes
1answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
0
votes
1answer
58 views

How to get information about segments of physical memory not described in System.map on linux

When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64: 00000000000228c0 D softnet_data 0000000000022a80 d ...
2
votes
1answer
80 views

Can a host OS be attacked through the network stack?

Forenote: I'm not familiar with how virtualisation works on a low-level (but I'd certainly like to learn) so this question could arise from ignorance. Example Scenario: One virtualised router is ...
0
votes
1answer
189 views

How do you adjust offest and kernel stack size from an exploit?

Needless to I say I have no idea how to do this. I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298 In the exploit comments, the author said : ...
0
votes
2answers
76 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
0
votes
1answer
160 views

AES-256 ESSIV in dm-crypt

I am playing around with disk encryption. https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt#iv-generators says: essiv: "encrypted sector|salt initial vector", the sector number is encrypted ...
1
vote
0answers
54 views

Kernel ROP crashes running OS

I was experimenting to see if I can make an ROP chain within the kernel. In the kernel debugging mode, I can make the first jump to an arbitrary gadget address without any problem. But the problem ...
0
votes
1answer
169 views

What is the best way to restrict /proc fs from malicious users (linux)?

I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions. kernel document says we can do that by setting hidepid and gid in /etc/fstab. It ...
16
votes
3answers
23k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
0
votes
1answer
163 views

Vulnerable stored Linux kernel version

I am scanning Linux server which has two kernels versions stored, when I run following command I can see for example this version: user@host [~]# rpm -q kernel kernel-3.10.0-327.el7.x86_64 kernel-3....
1
vote
0answers
59 views

Kernel exploit fails after executing first command

While trying to solve old ctf task (https://blog.frizn.fr/plaidctf-2013/pwn-400-servr) I've encountered a situation which I don't understand. TLTR After escalating process privileges my exploit ...
0
votes
1answer
95 views

Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?

We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary. We're in the process of ...
5
votes
1answer
587 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
5
votes
1answer
195 views

Can a non-privileged user modify the file descriptor table of an elevated process?

In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel. Is it possible that a non-...
1
vote
1answer
2k views

Do Linux kernels have guard pages?

I'm new to the Linux kernel, how does the Linux kernel memory management use guard pages (if this feature even exists)?
28
votes
2answers
3k views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
0
votes
1answer
83 views

Is exploit different from the kernel level or root?

i'm searching privilage escalation. there is some way if you looking at. i trying exploit in my lab machine like vulnhub. there is a diagram for understanding differents. anyway I told you a little. ...
1
vote
1answer
204 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
4
votes
1answer
304 views

Does printk() cause any security issues?

I'm asking myself if the function printk() causes security issues on Linux. When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
3
votes
1answer
171 views

How does Windows schedule a thread when the thread has no process?

I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
0
votes
0answers
374 views

VDSL modem getting probed?

My ZyXEL VMG8924-B30A VDSL modem recently had these alerts in its log. The WAN IP address of the modem is 10.225.205.128. There was nothing like this before 1 May. What is this? 2019 -05 -01 T16:05:...
1
vote
1answer
178 views

Why it is difficult to write an application to protect 100% against keyloggers?

When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply ...
1
vote
1answer
663 views

linux kernel exploit shellcode causes segfault

I'm learning how to write kernel exploits and my shellcode keeps seg faulting. I'm getting the memory address for commit_creds(prepare_kernel_cred(0)); #grep commit_creds /proc/kallsyms c907eea0 T ...
1
vote
0answers
138 views

Secure way to sign virtualbox module for secure boot

I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
2
votes
0answers
55 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
6
votes
1answer
3k views

Can a kernel exploit compromise an OpenVZ host?

As OpenVZ runs on a lot of virtual servers, I would like to know how kernel exploits would affect the whole system. Would it be possible to break out of an OpenVZ container (virtuozzo, etc) with a ...
2
votes
1answer
2k views

Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]

I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel. Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
5
votes
2answers
4k views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
7
votes
1answer
1k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
3
votes
1answer
303 views

Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?

Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...