io_uring based rootkit can bypass syscall-focused Linux security tools • Hacker News Board

Re: io_uring based rootkit can bypass syscall-focused Linux security tools

#11

Post by PeterWhittaker » Fri, Apr 25, 2025, 11:43 AM UTC

This isn't a "bypass" (and it certainly isn't "terrifying", as reported on /. and elsewhere).

1. The program can only do what it is permitted to do: io_uring just reduces the number of system calls required - but since it works on file descriptors, you must have already acquired the fd in the correct mode.

2. Some monitoring systems hook into system calls and report when they are used: io_uring and opcodes mean the program can perform actions without being noticed by these programs...

3. ...which can report on the use of the system calls that set up io_uring access...

4. ...and could report on the resuting I/O by other means.

I won’t go so far as to say this is a nothing burger, but it feels close.

Re: io_uring based rootkit can bypass syscall-focused Linux security tools

#12

Post by wmf » Fri, Apr 25, 2025, 3:27 PM UTC

hellow0rld123 wrote: post #10

wmf wrote: post #6

These security tools need to block any system call they don't recognize (fail closed). Obviously this breaks some apps but the alternative is huge security holes.

Maybe not blocking, but the problem is that they rely on system calls for visability for system events and that's the problem because we have mechanisms like io_uring which can allow attackers to so certain actions without making any system calls.

io_uring is a system call. Security tools could analyze it but they don't because they haven't been updated.

Re: io_uring based rootkit can bypass syscall-focused Linux security tools

#13

Post by yencabulator » Fri, Apr 25, 2025, 8:27 PM UTC

PeterWhittaker wrote: post #11

This isn't a "bypass" (and it certainly isn't "terrifying", as reported on /. and elsewhere). 1. The program can only do what it is permitted to do: io_uring just reduces the number of system calls required - but since it works on file descriptors, you must have already acquired the fd in the correct mode. 2. Some monitoring systems hook into system calls and report when they are used: io_uring and opcodes mean the p…

> io_uring just reduces the number of system calls required - but since it works on file descriptors, you must have already acquired the fd in the correct mode.

With the caveat that you can open files through io_uring requests, too: https://www.man7.org/linux/man-pages/man3/io_uring_prep_open...

And they might not have traditional FDs: https://lwn.net/Articles/863071/

But yes, it's bad security architecture (fail-open), not updated fast enough.

The real answer is probably something more like Landlock, where it's the kernel's job to understand syscall semantics.

Re: io_uring based rootkit can bypass syscall-focused Linux security tools

#14

Post by PeterWhittaker » Fri, Apr 25, 2025, 11:31 PM UTC

yencabulator wrote: post #13

PeterWhittaker wrote: post #11

This isn't a "bypass" (and it certainly isn't "terrifying", as reported on /. and elsewhere). 1. The program can only do what it is permitted to do: io_uring just reduces the number of system calls required - but since it works on file descriptors, you must have already acquired the fd in the correct mode. 2. Some monitoring systems hook into system calls and report when they are used: io_uring and opcodes mean the p…

> io_uring just reduces the number of system calls required - but since it works on file descriptors, you must have already acquired the fd in the correct mode. With the caveat that you can open files through io_uring requests, too: https://www.man7.org/linux/man-pages/man3/io_uring_prep_open... And they might not have traditional FDs: https://lwn.net/Articles/863071/ But yes, it's bad security architecture (fail-ope…

True, but even those calls require appropriate permissions, and will fail if the program lacks said perms. (Just to emphasize the point that the original article doesn't provide a means of privilege escalation, nor exploit a vulnerability.)

Re: io_uring based rootkit can bypass syscall-focused Linux security tools

#15

Post by fmajid » Sat, Apr 26, 2025, 10:05 AM UTC

StressedDev wrote: post #4

arghwhat wrote: post #2

The title is somewhat misleading, as it suggests an io_uring issue when there is none - it's just that anti-virus solutions like Microsoft Defender try to monitor syscalls but don't monitor io_uring. They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense…

You are right that this is not an io_uring issue. I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.

Read Travis Ormandy’s take-downs of Sophos or Symantec antivirus software. They are so sloppily written they vastly increase your exposure, including zero-click exploitation by simply receiving a crafted message.

Re: io_uring based rootkit can bypass syscall-focused Linux security tools

#16

Post by croes » Sat, Apr 26, 2025, 10:19 AM UTC

StressedDev wrote: post #4

arghwhat wrote: post #2

The title is somewhat misleading, as it suggests an io_uring issue when there is none - it's just that anti-virus solutions like Microsoft Defender try to monitor syscalls but don't monitor io_uring. They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense…

You are right that this is not an io_uring issue. I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.

Anti virus is also a good second attack vector so sometimes anti virus is the reason for malware in the system in the first place.