search

trailofbits / krf

A kernelspace syscall interceptor and randomized faulter
https://blog.trailofbits.com/2019/01/17/how-to-write-a-rootkit-without-really-trying/
GNU General Public License v3.0
349 stars 35 forks source link

Linux Kernel Oops on module unload #50

Open hmwildermuth opened 4 years ago

hmwildermuth commented 4 years ago

A kernel oops is often caused on module unload. This is because a process can start a faulted blocking syscall, such as wait4 or select, then have the syscall table flushed and the module unloaded, so that when the syscall continues execution it is in the memory where the kernel module once was, causing a page fault.

woodruffw commented 4 years ago

Hmm, it's not a mitigation, but we could special-case these calls in krfctl and warn the user that enabling them is known to cause this.