Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
6
votes
2answers
968 views

Linux Kernel ROP - Returning to userland from kernel context?

I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
8
votes
1answer
505 views

Mitigating Meltdown by checking the faulting address in every page fault?

Short question Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
1
vote
1answer
337 views

How can a userspace linux process refer to a kernel address?

I would like help understanding a particular aspect of meltdown. My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
8
votes
3answers
2k views

Why is accessing kernel memory a security risk?

A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
25
votes
1answer
2k views

Which attacks are known that exploit the vulnerability known as Spectre?

As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'. What exactly the design flaw is, that was ...
3
votes
0answers
157 views

What is known about the latest vulnerability related to Linux Page Table Isolation patches? [duplicate]

Recently, on Hacker News front page, there was a post mentioning a new vulnerability that seems to affect Intel processors. The post is mostly speculation and there is no PoC or an exploit that I'm ...
26
votes
1answer
4k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
2
votes
1answer
1k views

What is KSPP (Kernel self-protection project)?

What is KSPP? I saw it being compared to and called a competitor to Grsecurity, but I can't find a patch or Git repository to download. Is it just an idea/manifesto or something real, with a concrete ...
2
votes
1answer
955 views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
5
votes
1answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
6
votes
2answers
5k views

Can mprotect() be used to change the permissions of .rodata?

The .rodata section in ELF files contains parts of the text segment that are not meant to be changed. By default, all pages from this section are read-only, and any attempt at modification will ...
1
vote
1answer
96 views

What architecture could be suitable for a secure environment?

According to these slides on replacing UEFI with Linux: Between Linux and the hardware are at least 2 ½ kernels. Are there any architectures that contain fewer layers between the main OS and the ...
1
vote
0answers
257 views

Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]

What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted. I am overwriting with, setting frame like this: /* * Setup the fake frame *...
1
vote
1answer
583 views

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]

Why it segfaults in __kernel_vsyscall+9? Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c (gdb) x/10x 0xb7fd9ce5 0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
1
vote
2answers
243 views

Can a running kernel be protected by underlying rings, BIOS etc?

I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME. But are there known examples where stuff runs underneath the kernel and can be used to ...
1
vote
1answer
2k views

Do Linux kernels have guard pages?

I'm new to the Linux kernel, how does the Linux kernel memory management use guard pages (if this feature even exists)?
6
votes
1answer
1k views

OpenBSD is implementing KARL. How does this improve security?

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer. It is called KARL, "Kernel Address Randomized Link". ...
7
votes
1answer
1k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
1
vote
1answer
91 views

Extreme buffer size consequences

What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
3
votes
1answer
171 views

How does Windows schedule a thread when the thread has no process?

I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
15
votes
2answers
3k views

Does a compromised kernel give complete control over a device?

It seems that a recent vulnerability in WiFi firmware allows an attacker to run code in kernel space, e.g. replace a kernel function with malicious code. In Android/Linux: Would that give an ...
5
votes
2answers
262 views

Is it possible for unprivileged user to modify/inject into other user's (root) process?

Although I'm not any kind of kernel specialist and I do not program in languages like C/C++ and thus I do not have deep understanding of critical concepts of managing processes at OS level I do have ...
0
votes
1answer
789 views

What hardware can a user-mode process access?

What hardware if any can a process in user-mode (as opposed to kernel mode) access without using system calls, e.g. without relying on the OS to do anything for it? This question should be operating ...
4
votes
2answers
2k views

Can USB ethernet passthrough to a KVM virtual machine isolate network-related kernel vulnerabilities?

I'm worried about the attack surface that the linux kernel networking stack, including nic drivers and packet filtering, offers to a remote attacker. So I'm planning to isolate as much of the ...
0
votes
1answer
84 views

Possible ways for hackers to alter kernel behaviour without root [closed]

I'm wondering is it possible to harm kernel (by injecting shared library, loadable module or something like that) without root. If yes, how hackers can achieve it?
2
votes
0answers
174 views

Why isn't the “RAP - Reuse Attack Protector” in the mainline Linux kernel?

https://grsecurity.net/rap_announce_ret.php https://grsecurity.net/download.php#test Q: If the RAP - Reuse Attack Protector - is such an extreme great idea, why isn't it already included in the ...
-1
votes
1answer
294 views

Few questions about kernel attacks

Yesterday I read something about kernel and possible attacks on it. And I have some questions about this attack approach: 1. Kernel is a core for whole OS. So if I take control over kernel can I do ...
4
votes
2answers
555 views

Randomizing system call numbers to prevent rootkits?

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs. With the specs, the ...
5
votes
3answers
431 views

Linux kernel crypto algorithms: potential exploitation?

I am interested in many of the crypto algorithms in the arch/x86/crypto branch of linux kernel: http://lxr.free-electrons.com/source/arch/x86/crypto/ and this: http://lxr.free-electrons.com/source/...
3
votes
1answer
908 views

Dirtycow runs (lib-c to root) fine but crashes on reboot

I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
2
votes
1answer
1k views

linux kernel security module smack transmutation example

In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
7
votes
1answer
414 views

Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?

This is probably more of a compliance question, so if there is a better place to ask, please let me know. Background: It is a long complex story, but we can't easily update our linux kernels due to ...
1
vote
1answer
143 views

What is 'Modular shell disassociation from kernel'

Under many difference resources (https://en.wikipedia.org/wiki/Code_injection for one), there are some great tips to defend against code injection. However, one of those is 'Modular shell ...
6
votes
2answers
7k views

Simple explanation of how Dirty COW works?

I am sure many of you remember the XKCD Heartbleed Explanation. In the same spirit, I would like to request an explanation for how the latest branded vulnerability, Dirty COW, works. Is it possible ...
5
votes
1answer
3k views

CVE-2016-5195 Dirty Cow on Android [duplicate]

I was wondering if there is a possibility to exploit the CVE-2016-5195 vulnerability on Android? Since Android runs on linux kernel, I would expect the answer to be yes. Yet, I was not able to find ...
69
votes
7answers
23k views

What is the possible impact of dirtyc0w a.k.a. “Dirty COW” bug?

I heard about Dirty COW but couldn't find any decent writeup on the scope of the bug. It looks like the exploit can overwrite any non-writable file, which makes me guess that local root is possible ...
4
votes
1answer
394 views

several questions about linux kernel debugging - memory examination

I've read this Does Linux kernel use DEP for kernel memory? but I'm debugging linux kernel (x86_64) on Vmware using vmware stub. I've attached gdb to my linux kernel. the kernel version is 3.x and I ...
9
votes
5answers
1k views

Why protect the Linux kernel from the root user?

What's the purpose of things like the modules_disabled and kexec_load_disabled sysctls and the locking down of /dev/mem and /dev/kmem? The idea behind them seems to be to prevent root from taking over ...
9
votes
2answers
1k views

How can the Magic SysRq key be dangerous for linux users?

The magic SysRq key is known for linux users to perform some actions when the system freeze , but it considered as dangerous command for users who have a physical access to the system: Some ...
1
vote
3answers
572 views

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel. For example: USN-2946-1 ...
8
votes
0answers
263 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
6
votes
1answer
741 views

Pegasus iOS exploit & Kernel Memory Corruption

I'm currently reading about Pegasus, the malware on iOS that uses 3 zero-days, in the Lookout Blogpost. Blog Post about Pegasus I'm a cs student in the first year and I understand that the malware ...
0
votes
1answer
430 views

Is my system infected with Operation Windigo in Kali Linux? [closed]

I did my research and the first things that I did to test my system was to run some commands based on my research. The problem is trying to determine if I am truly infected. Any, confirmation will be ...
40
votes
2answers
15k views

What is protection ring -1?

Due to the Lenovo firmware ThinkPwn bug I'm trying to understand privileges and rings. If the kernel is Ring 0 and SMM (System Management Mode) is Ring -2, what could be in between that is Ring -1?
4
votes
2answers
436 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
5
votes
2answers
4k views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
28
votes
2answers
3k views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
3
votes
1answer
136 views

Can the Android Snapdragon Vulnerabilities be used to root a phone permanently?

Would it be possible to use the discovered vulnerabilities (CVE-2016-0819 and CVE-2016-0805) to root a phone permanently without any dataloss and install applications like SuperSU?
7
votes
2answers
215 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...
2
votes
2answers
533 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...