Re: Kernel Rootkits

Allison
2005-04-15T19:15:43Z

Isn't the kernel code segment marked read-only ? How can the module
write into the function text in the kernel ? Shouldn't this cause some
kind of protection fault ?

thanks,
Allison

Lee Revell wrote:
> On Fri, 2005-04-15 at 18:15 +0000, Allison wrote:
> > Once these are loaded into the kernel, is there no way the kernel
> > functions can be protected ?
>
> No. If the attacker can load arbitrary code into the kernel, game over.
> Think about it.
>
> Lee
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/