0

It seems fairly obvious why user processes can't write or modify data on kernel address space. But I can't get my head around why they can't even read the data. I know that a segmentation trap would occur in that case but what is the reason behind it?

what could go wrong if a user process could only read data on kernel address space?

thanks in advance

Improve this question
1
  • 2
    I imagine if you were to allow this it would end up allowing information to leak between processes. One user's process shouldn't be able to read the memory of another user's process, but this may become possible when one process writes (passwords) to disk, they would momentarily be visible in kernel memory. Such memory may not be scrubbed and doing so would be a performance problem.
    – Philip Couling
    Nov 14, 2021 at 9:48

1 Answer 1

Reset to default
2

And it's even worse then just "accidentally" discovering passwords:

If you can read kernel space, then most likely you can also read other processes' memory. If you are considering a scenario where you can only read kernel space, then you can still read disk buffers, I/O buffers etc., so you can see all I/O to and from other processes.

That means all credentials, passwords and secrets are now yours for the taking: You just need to try to authenticate (e.g. execute sudo, etc.), and then watch what the other process does. Either it has credentials in process memory, or you can reconstruct them from the I/O you can see (because all computation is deterministic, and you'll be able to imitate what the other process does, even if you can't read its memory).

So being able to read kernel space gives you root credentials. Then you can do everything.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.