Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in the wild

Re:Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in... by chr15p on Monday June 20, 2022 @04:28AM (#31807732)

A kernel module doesn't have to match the kernel version, it has to be able to resolve all the symbols (function calls, variables etc) it uses into valid symbols supplied by the kernel you are loading on.

The greater the difference between the kernel version you compiled for, and the kernel version you are trying to load it on, the greater the chance something you are relying on changed and the module loader cant resolve all the symbols and so it fails.

So saying a kmod has to match the kernel version is good practice but the reality is not quite as strict.

Red Hat has a list of "white listed" symbols that they try to maintain across a major version of RHEL so if your kmod only relies on them and nothing else then it should load on any kernel version within that release. But that's a Red Hat thing, not a Linux kernel thing.

[ Parent | on HN ]

Re:Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found in... by xyzzy123 on Monday June 20, 2022 @08:34AM (#31809569)

Perhaps also worth noting that rootkits don't have to follow the usual rules; you don't have to rely on the kernel linker if you don't want to.

(Tradeoff of runtime DIY symbol resolution / code grovelling being it's more work, and more likely to be crashy).

As a rootkit author you have considerably more flexibility than most module authors who are constrained by "sanity", maintainability, accepted practice and licensing terms.

[ Parent | on HN ]