The Openwall project has released the LKRG 1.0.0 kernel module (Linux Kernel Runtime Guard), designed to verify the integrity of kernel structures and detect attempts to exploit vulnerabilities in the kernel. It is noted that the assignment of version number 1.0.0 marks the project's achievement of a mature state. The project code is distributed under the GPLv2 license.
The module is suitable for protection against attacks, manipulating already known vulnerabilities in the Linux kernel, as well as countering exploits that use yet unknown vulnerabilities unless special measures to bypass LKRG are applied. The protection is based on detecting unauthorized changes to the running kernel (integrity verification) and monitoring changes in the privileges of user processes (identifying the use of exploits).
Integrity checking is performed based on comparing hashes computed for the most critical memory areas and data structures of the kernel, such as IDT (Interrupt Descriptor Table), MSR, syscall tables, all procedures and functions, interrupt handlers, lists of loaded modules, the contents of the '.text' section of modules, and process attributes. The verification procedure is triggered periodically by a timer or upon specific events occurring in the kernel, such as the execution of setuid, setreuid, fork, exit, execve, and do_init_module system calls.
Detection of possible exploit usage and blocking attacks is carried out at the stage before the kernel grants access to resources (e.g., before opening a file), but after the process gains unauthorized privileges (e.g., UID change). When unauthorized process behavior is detected, it is forcefully terminated, which is sufficient to block many exploits. The overhead from the module's operation is estimated at 2-2.5%.
Support is provided for operating on systems with x86-64, AArch64 (ARM64), ARM32, and x86 architectures. LKRG 1.0.0 has been tested with kernels from various distributions, starting from kernel 3.10 from RHEL/CentOS 7 to 6.17-rc4 from the repository preparing for the release of Fedora 44. Packages are available for the distributions ALT Linux, Arch Linux, Astra Linux, Gentoo, Guix, NixOS, Rocky Linux, Whonix, Yocto, and OpenBMC. Packages built for Rocky Linux can be used in RHEL 8/9 and derivative distributions such as AlmaLinux 8/9, while packages for Whonix are available for Debian and Ubuntu.
Among the changes in the new version:
- Compatibility with Linux kernels up to version 6.17-rc4 has been ensured.
- When used with kernels starting from 6.13, the interception of remote calls to override_creds() and revert_creds() has been discontinued, limiting the detection of attacks that override the cred pointer. Efforts were made to compensate for these limitations by adding checks for cred pointer overwrites in other parts of the kernel.
- Excessive tracking of credentials for which integrity checking is not performed has been discontinued. This change has reduced the codebase by approximately 1500 lines.
- Support has been added for the mechanism introduced in Linux kernel 6.10 for creating temporary files in OverlayFS, using the O_TMPFILE option (ovl_tmpfile). This support is necessary to prevent false positives that occur when using isolated containers on systems with kernels 6.10-6.12.
- For x86_64 systems, support for Intel CET (Control-flow Enforcement Technology) has been added to protect executable code using IBT (indirect branch tracking) instructions, as well as software protection kCFI (kernel Control Flow Integrity) to block violations of normal execution order (control flow) caused by exploits that modify function pointers stored in memory.
- For connecting multiple handlers, the kprobes mechanism has replaced kretprobes, simplifying hook installation code and allowing for higher performance.
- The handling of process-specific (per-task shadow data) locks in the kernel has been reworked. By eliminating unnecessary locks, performance in accessing such data has improved.
- Errors that led to race conditions, integrity checking issues, and false positives have been eliminated.
- Support for building using Clang has been improved.
Source: opennet.ru
