[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20220421141144.GA10633@openwall.com>
Date: Thu, 21 Apr 2022 16:11:44 +0200
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com, lkrg-users@...ts.openwall.com
Subject: LKRG 0.9.3
Hi,
For those new to LKRG, it is a kernel module that performs runtime
integrity checking of the Linux kernel and detection of security
vulnerability exploits against the kernel.
We've just released LKRG 0.9.3, available on the LKRG project website:
https://lkrg.org
The following major changes have been made between LKRG 0.9.2 and 0.9.3:
*) Support new mainline kernels 5.17.x, 5.18-rc*, and hopefully beyond
*) Support loading into Xen PV guest kernels even on older CPUs without UMIP
*) Fix build on latest CentOS Stream 8 and upcoming RHEL 8.6+
*) Fix build on CentOS Stream 9
*) Fix build on openSUSE Leap
*) Continuous Integration and debugging build updates and improvements
At the time of our previous release, LKRG 0.9.2, Linux 5.16-rc* were the
latest. We were lucky that it also worked as-is on Linux 5.16.x.
However, for compatibility with Linux 5.17+ we promptly made changes to
LKRG, which were available in our git repository - and are now in our
new release.
Under the hood, LKRG grew just a little bit:
$ git diff --shortstat v0.9.2..v0.9.3
33 files changed, 252 insertions(+), 69 deletions(-)
and got a moderate number of changes, by the following people:
$ git shortlog -sn v0.9.2..v0.9.3
11 Vitaly Chikunov
8 Solar Designer
4 Mariusz Zaborski
3 Adam 'pi3' Zabrocki
2 RageLtMan
1 John Helmert III
1 Vladimir D. Seleznev
As usual so far, the key changes in this release are Adam's. Notable to
our project was Vitaly's ongoing support of the Continuous Integration
(adding several more distros) and Mariusz' debugging build updates.
Finally, something that should have been in our previous release
announcement, but I forgot. I guess better late than never. Last year,
Alexander Popov came up with and published a writeup on an LKRG bypass,
demonstrated as a modification of his CVE-2021-26708 PoC exploit:
https://www.openwall.com/lists/lkrg-users/2021/08/26/1
We greatly appreciate Alexander's work on this. As mentioned on
lkrg-users back then, the bypass can be mitigated by setting the
sysctl's lkrg.hide=1 and/or kernel.kptr_restrict=2. For now, that's
still the case. We're going to look into having LKRG further hide
itself and/or hide kernel version specifics, possibly by default.
As usual, we welcome any feedback on the lkrg-users mailing list.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
