Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
69
votes
7answers
23k views

What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?

I heard about Dirty COW but couldn't find any decent writeup on the scope of the bug. It looks like the exploit can overwrite any non-writable file, which makes me guess that local root is possible ...
40
votes
2answers
16k views

What is protection ring -1?

Due to the Lenovo firmware ThinkPwn bug I'm trying to understand privileges and rings. If the kernel is Ring 0 and SMM (System Management Mode) is Ring -2, what could be in between that is Ring -1?
29
votes
1answer
5k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
29
votes
2answers
3k views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
27
votes
4answers
3k views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
26
votes
1answer
2k views

Which attacks are known that exploit the vulnerability known as Spectre?

As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'. What exactly the design flaw is, that was ...
17
votes
3answers
27k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
15
votes
2answers
3k views

Does a compromised kernel give complete control over a device?

It seems that a recent vulnerability in WiFi firmware allows an attacker to run code in kernel space, e.g. replace a kernel function with malicious code. In Android/Linux: Would that give an ...
14
votes
1answer
788 views

Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]

Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization. We did the benchmarks, and it seems that performance is almost not ...
13
votes
2answers
893 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
11
votes
5answers
2k views

Why protect the Linux kernel from the root user?

What's the purpose of things like the modules_disabled and kexec_load_disabled sysctls and the locking down of /dev/mem and /dev/kmem? The idea behind them seems to be to prevent root from taking over ...
10
votes
1answer
5k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
9
votes
2answers
446 views

How effective is Windows KDP for exploit mitigation in practice?

Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
9
votes
2answers
2k views

How can the Magic SysRq key be dangerous for linux users?

The magic SysRq key is known for linux users to perform some actions when the system freeze , but it considered as dangerous command for users who have a physical access to the system: Some ...
9
votes
0answers
316 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
8
votes
3answers
2k views

Why is accessing kernel memory a security risk?

A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
8
votes
1answer
575 views

Mitigating Meltdown by checking the faulting address in every page fault?

Short question Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
7
votes
1answer
2k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
7
votes
2answers
249 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...
7
votes
1answer
472 views

Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?

This is probably more of a compliance question, so if there is a better place to ask, please let me know. Background: It is a long complex story, but we can't easily update our linux kernels due to ...
6
votes
2answers
7k views

Simple explanation of how Dirty COW works?

I am sure many of you remember the XKCD Heartbleed Explanation. In the same spirit, I would like to request an explanation for how the latest branded vulnerability, Dirty COW, works. Is it possible ...
6
votes
1answer
3k views

Can a kernel exploit compromise an OpenVZ host?

As OpenVZ runs on a lot of virtual servers, I would like to know how kernel exploits would affect the whole system. Would it be possible to break out of an OpenVZ container (virtuozzo, etc) with a ...
6
votes
2answers
5k views

Can mprotect() be used to change the permissions of .rodata?

The .rodata segment in ELF files contains data that is not meant to be changed. By default, all pages from this segment are read-only, and any attempt at modification will trigger a general protection ...
6
votes
1answer
951 views

Pegasus iOS exploit & Kernel Memory Corruption

I'm currently reading about Pegasus, the malware on iOS that uses 3 zero-days, in the Lookout Blogpost. Blog Post about Pegasus I'm a cs student in the first year and I understand that the malware ...
6
votes
1answer
2k views

OpenBSD is implementing KARL. How does this improve security?

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer. It is called KARL, "Kernel Address Randomized Link". ...
6
votes
2answers
565 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
6
votes
2answers
1k views

Linux Kernel ROP - Returning to userland from kernel context?

I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
5
votes
1answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
5
votes
3answers
483 views

Linux kernel crypto algorithms: potential exploitation?

I am interested in many of the crypto algorithms in the arch/x86/crypto branch of linux kernel: http://lxr.free-electrons.com/source/arch/x86/crypto/ and this: http://lxr.free-electrons.com/source/...
5
votes
2answers
318 views

Is it possible for unprivileged user to modify/inject into other user's (root) process?

Although I'm not any kind of kernel specialist and I do not program in languages like C/C++ and thus I do not have deep understanding of critical concepts of managing processes at OS level I do have ...
5
votes
3answers
3k views

Is the Linux kernel vulnerable to LazyFP (CVE-2018-3665)?

Recently, a side-channel attack was discovered that exploits lazy FPU state switching to leak the contents of MMX, SSE, and AVX registers. The vulnerability can only be exploited when lazy FPU saves ...
5
votes
2answers
4k views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
5
votes
1answer
864 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
5
votes
1answer
261 views

Can a non-privileged user modify the file descriptor table of an elevated process?

In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel. Is it possible that a non-...
5
votes
1answer
3k views

CVE-2016-5195 Dirty Cow on Android [duplicate]

I was wondering if there is a possibility to exploit the CVE-2016-5195 vulnerability on Android? Since Android runs on linux kernel, I would expect the answer to be yes. Yet, I was not able to find ...
4
votes
2answers
516 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
4
votes
2answers
627 views

Randomizing system call numbers to prevent rootkits?

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs. With the specs, the ...
4
votes
1answer
389 views

Does printk() cause any security issues?

I'm asking myself if the function printk() causes security issues on Linux. When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
4
votes
1answer
391 views

Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?

Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...
4
votes
2answers
2k views

Can USB ethernet passthrough to a KVM virtual machine isolate network-related kernel vulnerabilities?

I'm worried about the attack surface that the linux kernel networking stack, including nic drivers and packet filtering, offers to a remote attacker. So I'm planning to isolate as much of the ...
4
votes
1answer
446 views

several questions about linux kernel debugging - memory examination

I've read this Does Linux kernel use DEP for kernel memory? but I'm debugging linux kernel (x86_64) on Vmware using vmware stub. I've attached gdb to my linux kernel. the kernel version is 3.x and I ...
4
votes
1answer
826 views

Security research on Operating system security measures, where to start?

I am researching on operating system security, And I don't know where to look for more information on this. I could find the following sources, but I need more guidance. Sources: Microkernel ...
4
votes
0answers
160 views

What is known about the latest vulnerability related to Linux Page Table Isolation patches? [duplicate]

Recently, on Hacker News front page, there was a post mentioning a new vulnerability that seems to affect Intel processors. The post is mostly speculation and there is no PoC or an exploit that I'm ...
3
votes
1answer
366 views

Injecting data into the Windows entropy pool

On Linux, it is possible for userspace to mix arbitrary data with the kernel entropy pool by writing to the /dev/urandom device. Is there any equivalent on Windows which does not require SYSTEM?
3
votes
1answer
2k views

What is KSPP (Kernel self-protection project)?

What is KSPP? I saw it being compared to and called a competitor to grsecurity, but I can't find a patch or Git repository to download. Is it just an idea/manifesto or something real, with a concrete ...
3
votes
1answer
353 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
3
votes
1answer
2k views

How detrimental is a NULL pointer dereference vulnerability today?

Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then ...
3
votes
1answer
1k views

Dirtycow runs (lib-c to root) fine but crashes on reboot

I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
3
votes
1answer
4k views

How secure is QEMU/KVM? [closed]

I'm worrying about the security of the VM host machine (against guests) as the Kernel-Based Vitrual Machine operates at kernel level. UPDATE: Is there any guarantee that a guest can't manipulate/...
3
votes
1answer
655 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...