Can a user mode program access the kernel memory and the memory of other processes?

Question

I have read in many tutorials that a user mode program cannot access the kernel memory and the memory of other processes.

But is this always true?

For example: couldn't the kernel map the kernel memory or the memory of some other process to the virtual address space of some process?

Answer 1

You can read kernel address by reading the file /dev/mem.

You need to be root and the Linux kernel need to be compiled with CONFIG_STRICT_DEVMEM=n (many distributions enable CONFIG_STRICT_DEVMEM by default for security)

You can try this GitHub project I wrote: link

Answer 2

At least one prog I use takes advantage of using kernel space, netsniff-ng. Netsniff-ng is a zero-copy mechanism for capturing frames. It takes advantage by mapping the kernel space to user space. Specifically using the SOCKET_MMAP syscall. The results are fantastic. I have used to capture frames on a switch port running 2.1 Gbps with zero dropped frames.

Click here to see how the SOCKET_MMAP syscall functions and it may give you some ideas

Answer 3

To access memory of other processes, you need capabilities that normal users do not have. However if you gain these capabilities, e.g. by becoming root, then you can do it.