0

I have read that it is dangerous for a program to run in kernel mode because it would have access to kernel memory.

I am looking for realistic examples of what damage can a buggy program running in kernel mode can make.

Can I say for example that such damage can be that the program can overwrite part or all of the scheduler instructions in memory, and so the next time that the scheduler need to run, the CPU will execute garbage instructions?

And what would happen if damage like this happen? I believe that in Windows, a blue screen will occur, but what would happen in Linux?

2

Can I say for example that such damage can be that the program can overwrite part or all of the scheduler instructions in memory, and so the next time that the scheduler need to run, the CPU will execute garbage instructions?

Yes, a kernel module or a kernel thread would be able to overwrite part or all of anything in memory.

It might cause the kernel to crash with a "panic" error message. If it does extremely wrong things, it might cause the system to freeze immediately, unable to even output an error message.

These are the best results, since these are immediately noticeable.

More insidious cases would be that the buggy code might corrupt a few bytes here and there without causing an immediate crash. If it hits the code or data of any user-space process, that process might misbehave or crash, or process corrupted information and output wrong results. Your system might become vaguely unreliable with no apparent rhyme or reason.

Or it might corrupt outgoing data in the disk I/O buffer, causing errors to accumulate in your files and filesystem metadata. If the misbehaving bit of kernel code corrupts a disk encryption key in RAM just before the system is going to make a large write operation to the encrypted disk, it might cause that write operation to happen using a wrong encryption key - effectively making that data unrecoverable unless you'd manage to figure out exactly what has happened. And if that write operation included some essential filesystem metadata, your filesystem would now be badly corrupted and cause you to lose large amounts of data, up to the entire contents of the encrypted filesystem in the worst case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.