Kiddy — a module for the Linux kernel designed to reduce the risks of exploiting (some) kernel vulnerabilities.
The protection mechanism implemented in this module is based on a simple idea, which is that during an attack, the object of the attack is identified in some way. Therefore, if this identification is complicated, it can significantly increase the difficulty of exploitation, as in many cases ready-made exploits contain tables of various offsets corresponding to the target kernel versions.
For example, this is how it's done for CVE-2017-1000112. It can also be seen that the kernel version identification is done using uname.
The developed module is simple to implement and allows:
- to change the kernel identification;
- to restrict access to the kernel log (dmesg);
- to restrict access to certain files in /proc that also contain identifying information;
- to restrict access to files and folders that potentially contain identifying information;
- to change the kernel version identification available through vDSO.
During the build process, the module allows the use of so-called "presets" that implement various logics for changing identification. For example, using the "windows" preset, you can achieve the following behavior:
Before loading the module
$ ./misc/id.sh ** UNAME identity leaks — uname -r 2.6.32-754.35.1.el6.x86_64 — uname -v #1 SMP Sat Nov 7 12:42:14 UTC 2020 — uname -a Linux localhost.localdomain 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux ** PROCFS identity leaks — /proc/cmdline ro root=/dev/mapper/VolGroup00-LogVol00 rd_NO_LUKS no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 rd_LVM_LV=VolGroup00/LogVol01 rd_LVM_LV=VolGroup00/LogVol00 KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet — /proc/version Linux version 2.6.32-754.35.1.el6.x86_64 (mockbuild@x86-02.bsys.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC)) #1 SMP Sat Nov 7 12:42:14 UTC 2020 — /proc/sys/kernel/version #1 SMP Sat Nov 7 12:42:14 UTC 2020 — /proc/sys/kernel/osrelease 2.6.32-754.35.1.el6.x86_64 which: no hostnamectl in (/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/vagrant/bin)
After loading the module
$ ./misc/id.sh ** UNAME identity leaks — uname -r Windows — uname -v NT 4.0 — uname -a Linux localhost.localdomain Windows NT 4.0 x86_64 x86_64 x86_64 GNU/Linux ** PROCFS identity leaks — /proc/cmdline EFIMicrosoftBootbootmgfw.efi — /proc/version Windows NT 4.0 — /proc/sys/kernel/version NT 4.0 — /proc/sys/kernel/osrelease Windows which: no hostnamectl in (/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/vagrant/bin)
Script kiddies won't get through!
Forrás: linux.org.ru
