PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Defeating eBPF Uprobe Monitoring

blog.quarkslab.com | research | #cloud | #linux | #exploitation | #kernel | #monitoring | #ebpf | #uprobes
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Research into eBPF uprobe monitoring on Linux: the basics of hooking userland programs, and flaws found in uprobes that allow monitored programs to evade this monitoring.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
blog · blog.trailofbits.com
Use our suite of eBPF libraries
Trail of Bits introduces its open-source eBPF libraries - linuxevents, ebpfpub, btfparse, ebpf-common - for process monitoring, function tracing, and kernel symbol parsing with minimal dependencies.
blog · projectzero.google
Taking a page from the kernel's book: A TLB issue in mremap()
This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.
vulnerability · projectzero.google
Exploiting the Linux kernel via packet sockets
A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.
blog · projectzero.google
Exploiting Recursion in the Linux Kernel
A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.
blog · netspi.com
Using strace to monitor SSH connections on Linux
Instead of replacing SSH binaries on a compromised Linux host, testers can attach strace to running sshd via ptrace and read write() system calls to capture passwords and session content live.
Back