73
votes
Accepted
What is protection ring -1?
The "rings" nomenclature (0-3) you usually see these days started with the requested privilege level field in segment selectors as part of the design of x86 protected mode.
Back in the day, it was ...
- 2,114
55
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already.
A classic example would be a web shell. Say the server is running a web ...
- 1,253
29
votes
Will installing a kernel mode driver onto a PC compromise the entire network it's connected to?
Is it possible?
Could a kernel mode driver deeply compromise your computer?Yes, kernel mode driver have very high privileges on the system.
Could a compromised computer affect the whole network it is ...
- 205k
28
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
The dirty cow vulnerability, is a a privilege escalation vulnerability in Linux kernel versions 2.6.22 and higher; it has existed since 2007 and was fixed on Oct 18, 2016.
What is the possible impact ...
- 2,241
22
votes
Does a compromised kernel give complete control over a device?
Running code in "kernel space" means running it in the ring 0 space. In other words, it is the strict definition of "having total control".
The only exception would be if you are running a hypervisor....
- 18.7k
17
votes
Accepted
Does a compromised kernel give complete control over a device?
Would that give an attacker complete control over the phone? For example, could they install a keylogger or other malware?
This is possible. Since any permission checks (i.e. file access, access to ...
- 205k
16
votes
Simple explanation of how Dirty COW works?
You and 3 other people are studying for a test, using the same notes.
You say "I gotta go, I need to make a copy of these notes for myself that I can mark up... let me go make a copy!"
You take the ...
- 73.1k
14
votes
Accepted
Simple explanation of how Dirty COW works?
I'm not a linux kernel expert, but I am familiar with the concepts involved and I read Linus' comment and the diff. I'll give it a go - perhaps people can correct me if I get it wrong and we'll hash ...
- 6,381
14
votes
How can you detect kernel exploits?
No, there is nothing all kernel exploits have in common.
Or at least, there is nothing unique to them and not present in standard, legal interaction with the kernel (such as using syscalls or ...
- 67.1k
12
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
CVE-2016-5195 is a so-called privilege escalation exploit. It allows you to elevate the privilege level from a normal Linux user to root. But privilege escalation exploits are usually local exploits (...
- 2,654
12
votes
Accepted
Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre?
The performance impact will vary greatly depending on what the program does.
After the Meltdown patch (KPTI) whenever there is a context switch from user-space to kernel-space there is a significant ...
- 851
10
votes
Accepted
How can the Magic SysRq key be dangerous for linux users?
It can be used to display CPU registers (which could contain bits of confidential information), forcibly unmount filesystems or reboot the computer, among other things (denial of service vulnerability)...
- 12.9k
10
votes
Accepted
Why is accessing kernel memory a security risk?
In order to understand the threat from Meltdown, you need to understand how memory is organized in modern computers.
The naive view of memory is that each memory address corresponds to a specific set ...
- 34.8k
9
votes
What is protection ring -1?
Ring -1 is the hypervisor, implemented as Intel VT-x ("Vanderpool") [Wikipedia] or AMD-V ("Pacifica") [Wikipedia].
- 3,424
9
votes
Is it necessary to understand Linux kernel internals to do binary exploitation?
Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, ...
- 67.1k
8
votes
Accepted
Pegasus iOS exploit & Kernel Memory Corruption
The exploit uses a combination of three vulnerabilities. Each vulnerability is a bug in an iOS component that allows the attacker to do things that are not supposed to be possible.
Stage 1 (CVE-2016-...
8
votes
Accepted
Security essentials for a embedded Linux device
Your considerations
Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently ...
- 67.1k
8
votes
Accepted
DMA attacks despite IOMMU isolation
Recently I had been reading the papers published at the NDSSS 2019, and this paper presented in February I think answers the question completely. At the time the question was asked, it seems like the ...
- 1,065
8
votes
Does CrowdStrike Falcon get validated by the Windows kernel as being crash-free?
CrowdStrike Falcon uses a Windows kernel-mode driver, and unlike the automated validation of eBPF programs on Linux, Windows kernel-mode drivers do not undergo the same type of in-depth validation to ...
- 1,454
7
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
At least it does affect Android 5.0.1 (Kernel Version 3.10.54+). I just tried out this code on a device using Termux and editing a file owned by root works flawlessly. I like that, because there is no ...
- 171
7
votes
Accepted
Can mprotect() be used to change the permissions of .rodata?
Sections do not exist in the context of a running process, only segments.
mprotect can be used to change the permissions of the pages the text segment is mapped to. Here is a tutorial on how to ...
- 1,299
6
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
How scary is it?
In principle, a privilege escalation is quite scary since it more or less renders all access control meaningless. In practice, it hopefully matters little. You first have to have ...
- 5,221
6
votes
Is Linux kernel supported by Linux Mint 17 LTS vulnerable?
Linux Mint founder and lead developer Clement Lefebvre responded to these accusations with a blog post on segfault.linuxmint.com in 2013.
I hear [Oliver Grawert, a Canonical-employed Ubuntu developer]...
- 263
6
votes
Accepted
Why protect the Linux kernel from the root user?
If an attacker gets root, don't they pretty much own the machine even without kernel access, by doing things like modifying binaries?
Maybe, maybe not. With SELinux, you can restrict access to block ...
- 1,230
6
votes
Accepted
Is it possible for unprivileged user to modify/inject into other user's (root) process?
This is far from being a simple task thanks to memory protection techniques.
In the old times of MS-DOS, Windows 9x and equivalent home computing systems, the memory was indeed equally shared amongst ...
- 19.3k
6
votes
Accepted
OpenBSD is implementing KARL. How does this improve security?
From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects.
With KASLR, you make it harder for ROP gadgets to overwrite (e.g., ...
- 2,656
6
votes
Accepted
Does printk() cause any security issues?
I'm asking myself if the function printk() is a security issue on Linux.
This depends on whether or not there are any printk() calls which may print unsanitized pointers. Generally, pointers will be ...
- 67.1k
6
votes
Will installing a kernel mode driver onto a PC compromise the entire network it's connected to?
Another thing worth noting is that your computer has many kernel mode drivers and adding some random fly by night hardware might present a greater risk that you do not even know about. For the anti-...
- 3,299
5
votes
Randomizing system call numbers to prevent rootkits?
That'd be a very disruptive thing to do; you wouldn't be able to run any binary on your system, and would have to compile everything from scratch; including the compiler.
Security by obscurity hardly ...
- 3,306
Only top scored, non community-wiki answers of a minimum length are eligible