One way is to create listening socket for some protocol, and module for that protocol will be loaded. For example, DCCP and SCTP.

Are there other ways?

UPD: Use case: virtual machine somewhere in AWS/Azure/... An attacker got local unprivileged user shell. No hardware changes can be done by unprivileged used. There is local privilege escalation vulnerability in kernel module that is not loaded now. How can he load this module to use it?

Question inspired by recent vulnerability in DCCP protocol kernel module.

UPD2: According to CVE-2017-2636, it's possible to load n_hdlc kernel module just by "activating HDLC for tty device" (russian article on CVE-2017-2636). So there are other ways, but nobody with this sacred knowledge was interested in the question :(

  • 3
    This doesn't answer your question, but if you're worried about users loading modules, and if you know you already have loaded all the modules you'll need, you can disable further module loading with sysctl kernel.modules_disabled=1. You might find lockdown interesting. – Stephen Kitt Mar 2 '17 at 13:03
  • @StephenKitt Thanks, I know about this option. lockdown in nice, I've found other interesting hardening option kernel.unprivileged_bpf_disabled. – Selivanov Pavel Mar 2 '17 at 13:38

Many file-system drivers are implemented as kernel modules and will be loaded on demand, either because of user mounts or by the automount daemon.

Additionally there is whole range of hot-plug devices where plugging them in will result in the kernel loading the required kernel module to manage them, with USB peripherals a very big sub category therein,

|improve this answer|||||
  • Good point, module loading can be triggered by attaching devices and by mounting with udisks/autofs/... Any other ways on virtual machine, where no hardware changes are possible? Updated the question. If nobody has anything to add, I'll later accept this answer – Selivanov Pavel Mar 1 '17 at 9:23
  • No comprehensive answers even with bounty :( So I have to accept this one – Selivanov Pavel Mar 9 '17 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.