I have read in many tutorials that a user mode program cannot access the kernel memory and the memory of other processes.

But is this always true?

For example: couldn't the kernel map the kernel memory or the memory of some other process to the virtual address space of some process?


At least one prog I use takes advantage of using kernel space, netsniff-ng. Netsniff-ng is a zero-copy mechanism for capturing frames. It takes advantage by mapping the kernel space to user space. Specifically using the SOCKET_MMAP syscall. The results are fantastic. I have used to capture frames on a switch port running 2.1 Gbps with zero dropped frames.

Click here to see how the SOCKET_MMAP syscall functions and it may give you some ideas


You can read kernel address by reading the file /dev/mem.

You need to be root and the Linux kernel need to be compiled with CONFIG_STRICT_DEVMEM=n (many distributions enable CONFIG_STRICT_DEVMEM by default for security)

You can try this GitHub project I wrote: link


To access memory of other processes, you need capabilities that normal users do not have. However if you gain these capabilities, e.g. by becoming root, then you can do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.