Questions tagged [kernel]
The kernel tag has no usage guidance.
135
questions
1
vote
0
answers
237
views
Secure way to sign virtualbox module for secure boot
I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
- 15.6k
2
votes
0
answers
103
views
How is CVE-2016-6787 a UAF bug in Linux kernel?
From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
- 529
2
votes
1
answer
3k
views
Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]
I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel.
Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
- 2,017
3
votes
0
answers
161
views
Identifying kernel pointer infoleaks via static analysis
Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
- 65.8k
4
votes
1
answer
471
views
Does printk() cause any security issues?
I'm asking myself if the function printk() causes security issues on Linux.
When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
- 43
1
vote
1
answer
689
views
Is Debian 9.5 stretch vulnerable to CVE-2018-17182?
I have a Debian system running the following kernel version:
Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
- 255
2
votes
2
answers
2k
views
How protected mode in CPU is really implemented?
I know what is real and protected mode of cpu execution. But how CPU implements protected mode ? AFAIK cpu does everything what the program says it to do. Where is the protected mode behaviour ...
- 169
0
votes
1
answer
1k
views
The older the Linux kernel is, the more secure?
Are there security benefits running Linux Distro base on an older version of Linux kernel?
Security benefits = fewer vulnerabilities that can be exploited by hackers.
Linux Distro base on older ...
- 53
3
votes
1
answer
376
views
How to fix Spectre variant 3a and variant 4?e
How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
- 31
1
vote
0
answers
201
views
Is there any modern scalable way to do system call monitoring?
I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
5
votes
3
answers
3k
views
Is the Linux kernel vulnerable to LazyFP (CVE-2018-3665)?
Recently, a side-channel attack was discovered that exploits lazy FPU state switching to leak the contents of MMX, SSE, and AVX registers. The vulnerability can only be exploited when lazy FPU saves ...
- 65.8k
3
votes
1
answer
417
views
Injecting data into the Windows entropy pool
On Linux, it is possible for userspace to mix arbitrary data with the kernel entropy pool by writing to the /dev/urandom device. Is there any equivalent on Windows which does not require SYSTEM?
- 65.8k
0
votes
0
answers
225
views
Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?
In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04
While related to the CVE in some way, the 'linux' package in xenial is
not affected.
But I have tested many kernel ...
- 281
4
votes
1
answer
537
views
Linux 'add_interrupt_randomness' implementation - low entropy contribution by cycles and jiffies?
Currently I'm analyzing the process of entropy generation of a Linux 64-bit kernel during system startup (for educational purpose). The system is hosted as/on a (64 bit) virtual machine (Xen domU). ...
- 43
2
votes
1
answer
1k
views
Kernel32.dll , Kernelbase.dll and Malware
I noticed that the same malware will export CreateProcessInternalW from kernel32.dll in Windows 7 and KernelBase.dll in Windows 10. Why is it exporting the same function from different DLLs?
- 119
1
vote
2
answers
144
views
Driver separation?
are there any (at least on plan or theoretical level) that drivers will be/are/would be separated in general? ex.:
touchpad drivers shouldn't have to do anything with network access
wireless drivers ...
- 199
4
votes
1
answer
2k
views
How detrimental is a NULL pointer dereference vulnerability today?
Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then ...
- 41
6
votes
2
answers
622
views
Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?
The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another.
On my Linux system currently I have all JavaScript disabled to eliminate ...
- 161
14
votes
1
answer
809
views
Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]
Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization.
We did the benchmarks, and it seems that performance is almost not ...
- 188
6
votes
2
answers
1k
views
Linux Kernel ROP - Returning to userland from kernel context?
I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
- 220
8
votes
1
answer
615
views
Mitigating Meltdown by checking the faulting address in every page fault?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
- 65.8k
1
vote
1
answer
427
views
How can a userspace linux process refer to a kernel address?
I would like help understanding a particular aspect of meltdown.
My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
- 183
8
votes
3
answers
2k
views
Why is accessing kernel memory a security risk?
A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
- 223
26
votes
1
answer
2k
views
Which attacks are known that exploit the vulnerability known as Spectre?
As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'.
What exactly the design flaw is, that was ...
- 7,945
4
votes
0
answers
160
views
What is known about the latest vulnerability related to Linux Page Table Isolation patches? [duplicate]
Recently, on Hacker News front page, there was a post mentioning a new vulnerability that seems to affect Intel processors. The post is mostly speculation and there is no PoC or an exploit that I'm ...
- 6,514
28
votes
1
answer
5k
views
DMA attacks despite IOMMU isolation
If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
- 65.8k
3
votes
1
answer
2k
views
What is KSPP (Kernel self-protection project)?
What is KSPP? I saw it being compared to and called a competitor to grsecurity, but I can't find a patch or Git repository to download.
Is it just an idea/manifesto or something real, with a concrete ...
- 219
2
votes
1
answer
1k
views
How to load a malicious LKM at startup?
How could a cracker force the loading of a kernel rootkit at boot? Is there a way to link the malicious module with another module so that it is loaded automatically without any insmod command?
- 53
5
votes
1
answer
2k
views
How can you detect kernel exploits?
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
- 51
7
votes
2
answers
5k
views
Can mprotect() be used to change the permissions of .rodata?
The .rodata segment in ELF files contains data that is not meant to be changed. By default, all pages from this segment are read-only, and any attempt at modification will trigger a general protection ...
- 65.8k
1
vote
1
answer
134
views
What architecture could be suitable for a secure environment?
According to these slides on replacing UEFI with Linux:
Between Linux and the hardware are at least 2 ½ kernels.
Are there any architectures that contain fewer layers between the main OS and the ...
- 143
1
vote
0
answers
309
views
Kernel 4.3.5 Exploitation x86 32 bit - Stack Structure [closed]
What is the Kernel 4.3.5 Linux x86 32 bit stack structure? Trying to overwrite it, but it shows it is corrupted.
I am overwriting with, setting frame like this:
/*
* Setup the fake frame
*...
- 947
1
vote
1
answer
762
views
Kernel x86 32 bit Stack Overflow - overwriting EIP segfaults in __kernel_vsyscall+9 [closed]
Why it segfaults in __kernel_vsyscall+9?
Did a inspection of EIP, broke just after fwrite(), line 93 in exp.c
(gdb) x/10x 0xb7fd9ce5
0xb7fd9ce5 <__kernel_vsyscall+9>: 0xc3595a5d 0x90909090 ...
- 947
1
vote
3
answers
354
views
Can a running kernel be protected by underlying rings, BIOS etc?
I mostly found examples the other way around: compromising the OS e.g. through a compromised BIOS or Intel ME.
But are there known examples where stuff runs underneath the kernel and can be used to ...
- 21
2
votes
1
answer
3k
views
Do Linux kernels have guard pages?
I'm new to the Linux kernel, how does the Linux kernel memory management use guard pages (if this feature even exists)?
- 121
7
votes
1
answer
2k
views
OpenBSD is implementing KARL. How does this improve security?
According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer.
It is called KARL, "Kernel Address Randomized Link". ...
- 3,176
8
votes
1
answer
2k
views
Security essentials for a embedded Linux device
We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
- 225
1
vote
1
answer
148
views
Extreme buffer size consequences
What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
- 131
3
votes
1
answer
228
views
How does Windows schedule a thread when the thread has no process?
I have heard that some rootkits try to hide themselves by destroying the process object (nt!_EPROCESS ?) but keeping the thread alive (nt!_ETHREAD ?) . That way they are not visible in tools like Task ...
- 3,376
15
votes
2
answers
3k
views
Does a compromised kernel give complete control over a device?
It seems that a recent vulnerability in WiFi firmware allows an attacker to run code in kernel space, e.g. replace a kernel function with malicious code. In Android/Linux:
Would that give an ...
- 333
5
votes
2
answers
352
views
Is it possible for unprivileged user to modify/inject into other user's (root) process?
Although I'm not any kind of kernel specialist and I do not program in languages like C/C++ and thus I do not have deep understanding of critical concepts of managing processes at OS level I do have ...
- 153
1
vote
1
answer
1k
views
What hardware can a user-mode process access?
What hardware if any can a process in user-mode (as opposed to kernel mode) access without using system calls, e.g. without relying on the OS to do anything for it? This question should be operating ...
- 169
4
votes
2
answers
3k
views
Can USB ethernet passthrough to a KVM virtual machine isolate network-related kernel vulnerabilities?
I'm worried about the attack surface that the linux kernel networking stack, including nic drivers and packet filtering, offers to a remote attacker. So I'm planning to isolate as much of the ...
- 9,208
0
votes
1
answer
130
views
Possible ways for hackers to alter kernel behaviour without root [closed]
I'm wondering is it possible to harm kernel (by injecting shared library, loadable module or something like that) without root. If yes, how hackers can achieve it?
- 125
2
votes
0
answers
227
views
Why isn't the "RAP - Reuse Attack Protector" in the mainline Linux kernel?
https://grsecurity.net/rap_announce_ret.php
https://grsecurity.net/download.php#test
Q: If the RAP - Reuse Attack Protector - is such an extreme great idea, why isn't it already included in the ...
- 31
-1
votes
1
answer
352
views
Few questions about kernel attacks
Yesterday I read something about kernel and possible attacks on it. And I have some questions about this attack approach:
1. Kernel is a core for whole OS. So if I take control over kernel can I do ...
- 125
4
votes
2
answers
696
views
Randomizing system call numbers to prevent rootkits?
I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs.
With the specs, the ...
- 143
5
votes
3
answers
540
views
Linux kernel crypto algorithms: potential exploitation?
I am interested in many of the crypto algorithms in the arch/x86/crypto branch of linux kernel:
http://lxr.free-electrons.com/source/arch/x86/crypto/
and this:
http://lxr.free-electrons.com/source/...
- 311
3
votes
1
answer
1k
views
Dirtycow runs (lib-c to root) fine but crashes on reboot
I have ubuntu 14.04.3 server running in a vm with kernel version 3.13.0-83-generic running. I have tested several PoC's gathered here. Most of them crash the kernel (not all the times but sometimes) ...
- 31
2
votes
1
answer
2k
views
linux kernel security module smack transmutation example
In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
- 165