I want to know if the root user can read from and write to sections of kernel code in memory. Can it?


Yes, usually the root user has sufficient privileges to modify kernel code indirectly, although there are mechanisms that can be used to restrict this, assuming sufficient security measures are taken into account. A non-exhaustive list of ways a privileged root user can modify kernel code:

  • The ioperm() and iopl() syscalls can set I/O port permissions.

  • Naturally, files in the boot directory (including the kernel) can be modified.

  • The /dev/mem, /dev/kmem, and /dev/port character devices allow direct memory access.

  • Various MSRs can be used to change low-level CPU behavior, breaking security.

  • The kexec functionality can be used to boot into a new kernel.

  • ACPI tables can be loaded by root at runtime, executing AML in the kernel.

  • ACPI custom_method can be abused to write directly to memory.

  • Kernel modules can be loaded by root if module signing is disabled.

  • Debugging features like kprobes can modify kernel behavior.

Mitigation can be done either by using a hardened kernel such as properly configured grsecurity, or by using the kernel lockdown patches which are to be upstreamed soon. It is still necessary to prevent the root user from writing to the bootloader or boot partition where the kernels live, of course.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.