Contents
What is kernel memory protection?
Kernel self-protection is the design and implementation of systems and structures within the Linux kernel to protect against security flaws in the kernel itself. In the worst-case scenario, we assume an unprivileged local attacker has arbitrary read and write access to the kernel’s memory.
How does virtual memory improve security?
The primary benefits of virtual memory include freeing applications from having to manage a shared memory space, ability to share memory used by libraries between processes, increased security due to memory isolation, and being able to conceptually use more memory than might be physically available, using the technique …
Is it safe for the kernel to directly execute user level code in any process address space?
Directly executing user code is also dangerous because the user code may do something indirect such as overwriting its code or writing out new code to a new page of memory and them jumping to it, and this code would then not be checked for security.
What is Windows NT kernel?
The Windows NT kernel is a monolithic kernel; the architecture comprises a simple kernel, hardware abstraction layer (HAL), drivers, and a range of services (collectively named Executive), which all exist in kernel mode. The kernel is also responsible for initializing device drivers at bootup.
Where is kernel memory stored?
All of kernel memory and user process memory is stored in physical memory in the computer (or perhaps on disk if data has been swapped from memory).
Is virtual memory still needed?
Most likely yes, because virtual memory has its perks and advantages. It keeps memory isolated from other processes, which means they cannot access each other data or corrupt them. This can give you a lot of peace of mind.
Can kernel access user space memory?
Whilst a user-space program is not allowed to access kernel memory, it is possible for the kernel to access user memory. However, the kernel must never execute user-space memory and it must also never access user-space memory without explicit expectation to do so.
What happens if you try to access unowned memory?
An attempt to access unowned memory results in a hardware fault, called a segmentation fault or storage violation exception, generally causing abnormal termination of the offending process. Memory protection for computer security includes additional techniques such as address space layout randomization and executable space protection .
Is it safe to store passwords in memory?
The kernel allows one process to read and write the memory of the other, through ptrace (), provided that both processes run under the same user ID, or that the process which does the ptrace () is a “root” process. Similar functionality exists in Windows. The bottom-line is that passwords in RAM are no safer than what the operating system allows.
How are load and store operations checked in memory protection?
Load and store operations are checked against both the page table permissions and the protection key permissions associated with the protection domain of the virtual address, and only allowed if both permissions allow the access.
Where do drivers live in the Windows kernel?
Drivers live in the Windows kernel, and having an issue when executing in kernel exposes the entire operating system. If any other option is available, it likely will be lower cost and have less associated risk than creating a new kernel driver.