Kiddy is a module for the Linux kernel developed to reduce the risks of exploiting (some) kernel vulnerabilities.
The core idea behind the protection mechanism implemented in this module is straightforward: during an attack, the target object is identified in one way or another. Therefore, by making this identification more difficult, the complexity of exploitation can be significantly increased, as many ready-made exploits contain tables of various offsets corresponding to targeted kernel versions.
For example, hereβs how it's done for CVE-2017-1000112. Here, it can also be seen that the identification of the kernel version is performed using uname.
The developed module is simple to implement and allows you to:
- change kernel identification;
- restrict access to the kernel log (dmesg);
- restrict access to certain files in /proc that also contain identifying information;
- restrict access to files and folders that may contain identifying information;
- change the kernel version identification available through vDSO.
During the module build process, it allows the use of so-called "presets" that implement various logic for changing identification. For example, using the "windows" preset, the following behavior can be obtained:
Before loading the module
$ ./misc/id.sh ** UNAME identity leaks β uname -r 2.6.32-754.35.1.el6.x86_64 β uname -v #1 SMP Sat Nov 7 12:42:14 UTC 2020 β uname -a Linux localhost.localdomain 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux ** PROCFS identity leaks β /proc/cmdline ro root=/dev/mapper/VolGroup00-LogVol00 rd_NO_LUKS no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 rd_LVM_LV=VolGroup00/LogVol01 rd_LVM_LV=VolGroup00/LogVol00 KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet β /proc/version Linux version 2.6.32-754.35.1.el6.x86_64 (mockbuild@x86-02.bsys.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC)) #1 SMP Sat Nov 7 12:42:14 UTC 2020 β /proc/sys/kernel/version #1 SMP Sat Nov 7 12:42:14 UTC 2020 β /proc/sys/kernel/osrelease 2.6.32-754.35.1.el6.x86_64 which: no hostnamectl in (/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/vagrant/bin)
After loading the module
$ ./misc/id.sh ** UNAME identity leaks β uname -r Windows β uname -v NT 4.0 β uname -a Linux localhost.localdomain Windows NT 4.0 x86_64 x86_64 x86_64 GNU/Linux ** PROCFS identity leaks β /proc/cmdline EFIMicrosoftBootbootmgfw.efi β /proc/version Windows NT 4.0 β /proc/sys/kernel/version NT 4.0 β /proc/sys/kernel/osrelease Windows which: no hostnamectl in (/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/vagrant/bin)
Scripts won't get through!
Source: linux.org.ru
