Re: [PATCH 1/9] Known exploit detection

Vegard Nossum
2013-12-13T08:22:51Z

On 12/12/2013 08:06 PM, Theodore Ts'o wrote:
> On Thu, Dec 12, 2013 at 05:52:24PM +0100, vegard.nossum@oracle.com wrote:
>> The idea is simple -- since different kernel versions are vulnerable to
>> different root exploits, hackers most likely try multiple exploits before
>> they actually succeed.
>
> Suppose we put put this into the mainstream kernel. Wouldn't writers
> of root kit adapt by checking for the kernel version to avoid checking
> for exploits that are known not work? So the question is whether the
> additional complexity in the kernel is going to be worth it, since
> once the attackers adapt, the benefits of trying to detect attacks for
> mitigated exploits will be minimal.

Yeah, you could probably avoid detection by being more careful. But I
think it would be worth making it harder; I'd argue that the "additional
complexity" in this case is minimal, since we are mostly talking about
~1 line added to an error path for each critical vulnerability.

Vegard