Questions tagged [kernel]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
807 views

How to load a malicious LKM at startup?

How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
5
votes
1answer
2k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
6
votes
2answers
4k views

Can mprotect() be used to change the permissions of .rodata?

The .rodata section in ELF files contains parts of the text segment that are not meant to be changed. By default, all pages from this section are read-only, and any attempt at modification will ...
1
vote
1answer
96 views

What architecture could be suitable for a secure environment?

According to these slides on replacing UEFI with Linux: Between Linux and the hardware are at least 2 ½ kernels. Are there any architectures that contain fewer layers between the main OS and the ...
1
vote
0answers
252 views

Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]

What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted. I am overwriting with, setting frame like this: /* * Setup the fake frame *...
1
vote
1answer
539 views

Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]

Why it segfaults in __kernel_vsyscall+9? Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c (gdb) x/10x 0xb7fd9ce5 0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
1
vote
2answers
187 views

Can a running kernel be protected by underlying rings, BIOS etc?

I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME. But are there known examples where stuff runs underneath the kernel and can be used to ...
1
vote
1answer
2k views

Do Linux kernels have guard pages?

I'm new to the Linux kernel, how does the Linux kernel memory management use guard pages (if this feature even exists)?
6
votes
1answer
1k views

OpenBSD is implementing KARL. How does this improve security?

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer. It is called KARL, "Kernel Address Randomized Link". ...
7
votes
1answer
1k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
1
vote
1answer
90 views

Extreme buffer size consequences

What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
3
votes
1answer
164 views

How does Windows schedule a thread when the thread has no process?

I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
15
votes
2answers
3k views

Does a compromised kernel give complete control over a device?

It seems that a recent vulnerability in WiFi firmware allows an attacker to run code in kernel space, e.g. replace a kernel function with malicious code. In Android/Linux: Would that give an ...
5
votes
2answers
233 views

Is it possible for unprivileged user to modify/inject into other user's (root) process?

Although I'm not any kind of kernel specialist and I do not program in languages like C/C++ and thus I do not have deep understanding of critical concepts of managing processes at OS level I do have ...
0
votes
1answer
681 views

What hardware can a user-mode process access?

What hardware if any can a process in user-mode (as opposed to kernel mode) access without using system calls, e.g. without relying on the OS to do anything for it? This question should be operating ...
4
votes
2answers
2k views

Can USB ethernet passthrough to a KVM virtual machine isolate network-related kernel vulnerabilities?

I'm worried about the attack surface that the linux kernel networking stack, including nic drivers and packet filtering, offers to a remote attacker. So I'm planning to isolate as much of the ...
0
votes
1answer
83 views

Possible ways for hackers to alter kernel behaviour without root [closed]

I'm wondering is it possible to harm kernel (by injecting shared library, loadable module or something like that) without root. If yes, how hackers can achieve it?
2
votes
0answers
171 views

Why isn't the “RAP - Reuse Attack Protector” in the mainline Linux kernel?

https://grsecurity.net/rap_announce_ret.php https://grsecurity.net/download.php#test Q: If the RAP - Reuse Attack Protector - is such an extreme great idea, why isn't it already included in the ...
-1
votes
1answer
280 views

Few questions about kernel attacks

Yesterday I read something about kernel and possible attacks on it. And I have some questions about this attack approach: 1. Kernel is a core for whole OS. So if I take control over kernel can I do ...
4
votes
2answers
503 views

Randomizing system call numbers to prevent rootkits?

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs. With the specs, the ...
5
votes
3answers
417 views

Linux kernel crypto algorithms: potential exploitation?

I am interested in many of the crypto algorithms in the arch/x86/crypto branch of linux kernel: http://lxr.free-electrons.com/source/arch/x86/crypto/ and this: http://lxr.free-electrons.com/source/...
3
votes
1answer
806 views

Dirtycow runs (lib-c to root) fine but crashes on reboot

I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
2
votes
1answer
1k views

linux kernel security module smack transmutation example

In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
6
votes
1answer
375 views

Is KernelCare kernel patching recognized as a valid method of patching kernels by 3rd party auditors and pen testers?

This is probably more of a compliance question, so if there is a better place to ask, please let me know. Background: It is a long complex story, but we can't easily update our linux kernels due to ...
1
vote
1answer
133 views

What is 'Modular shell disassociation from kernel'

Under many difference resources (https://en.wikipedia.org/wiki/Code_injection for one), there are some great tips to defend against code injection. However, one of those is 'Modular shell ...
6
votes
2answers
6k views

Simple explanation of how Dirty COW works?

I am sure many of you remember the XKCD Heartbleed Explanation. In the same spirit, I would like to request an explanation for how the latest branded vulnerability, Dirty COW, works. Is it possible ...
5
votes
1answer
3k views

CVE-2016-5195 Dirty Cow on Android [duplicate]

I was wondering if there is a possibility to exploit the CVE-2016-5195 vulnerability on Android? Since Android runs on linux kernel, I would expect the answer to be yes. Yet, I was not able to find ...
69
votes
7answers
23k views

What is the possible impact of dirtyc0w a.k.a. “Dirty COW” bug?

I heard about Dirty COW but couldn't find any decent writeup on the scope of the bug. It looks like the exploit can overwrite any non-writable file, which makes me guess that local root is possible ...
4
votes
1answer
364 views

several questions about linux kernel debugging - memory examination

I've read this Does Linux kernel use DEP for kernel memory? but I'm debugging linux kernel (x86_64) on Vmware using vmware stub. I've attached gdb to my linux kernel. the kernel version is 3.x and I ...
8
votes
5answers
1k views

Why protect the Linux kernel from the root user?

What's the purpose of things like the modules_disabled and kexec_load_disabled sysctls and the locking down of /dev/mem and /dev/kmem? The idea behind them seems to be to prevent root from taking over ...
9
votes
2answers
1k views

How can the Magic SysRq key be dangerous for linux users?

The magic SysRq key is known for linux users to perform some actions when the system freeze , but it considered as dangerous command for users who have a physical access to the system: Some ...
1
vote
3answers
561 views

Is Linux kernel supported by Linux Mint 17 LTS vulnerable?

During a local security check performed by nessus on a Linux Mint Qiana 17 LTS system, even if the host is perfectly updated, I have found 34 vulnerabilities about the kernel. For example: USN-2946-1 ...
7
votes
0answers
248 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
6
votes
1answer
709 views

Pegasus iOS exploit & Kernel Memory Corruption

I'm currently reading about Pegasus, the malware on iOS that uses 3 zero-days, in the Lookout Blogpost. Blog Post about Pegasus I'm a cs student in the first year and I understand that the malware ...
0
votes
1answer
424 views

Is my system infected with Operation Windigo in Kali Linux? [closed]

I did my research and the first things that I did to test my system was to run some commands based on my research. The problem is trying to determine if I am truly infected. Any, confirmation will be ...
39
votes
2answers
14k views

What is protection ring -1?

Due to the Lenovo firmware ThinkPwn bug I'm trying to understand privileges and rings. If the kernel is Ring 0 and SMM (System Management Mode) is Ring -2, what could be in between that is Ring -1?
4
votes
2answers
426 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
5
votes
2answers
3k views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
27
votes
2answers
2k views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
3
votes
1answer
135 views

Can the Android Snapdragon Vulnerabilities be used to root a phone permanently?

Would it be possible to use the discovered vulnerabilities (CVE-2016-0819 and CVE-2016-0805) to root a phone permanently without any dataloss and install applications like SuperSU?
7
votes
2answers
215 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...
2
votes
2answers
505 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
15
votes
3answers
21k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
10
votes
1answer
5k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
-1
votes
1answer
93 views

Host Based IDS with syscall monitoring

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys Can a rootkit be classified as an intrusion or is it a ...
-1
votes
1answer
294 views

Starting a server without SElinux or Apparmor [duplicate]

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However ...
2
votes
1answer
688 views

Effectiveness of Secure Boot on kernel-mode rootkit detection

With so many new patches and updates, how effect is Secure Boot on detecting kernel-mode rootkits?
26
votes
4answers
3k views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
4
votes
1answer
744 views

Security research on Operating system security measures, where to start?

I am researching on operating system security, And I don't know where to look for more information on this. I could find the following sources, but I need more guidance. Sources: Microkernel ...
1
vote
1answer
925 views

How is a exploit code mmaped in user space executed in kernel space?

I am reading about a Ubuntu-12.10 security exploit CVE-2013-1763 which describes the vulnerability of stack buffer overflow that can be exploited to escalate privilege of a process and gain root ...