Cybersecurity researchers have demonstrated a proof-of-concept (PoC) rootkit dubbed Curing that leverages a Linux asynchronous I/O mechanism known as io_uring to bypass conventional system name monitoring.
This causes a “main blind spot in Linux runtime safety instruments,” ARMO stated.
“This mechanism permits a person utility to carry out numerous actions with out utilizing system calls,” the corporate stated in a report shared with The Hacker Information. “In consequence, safety instruments counting on system name monitoring are blind’ to rootkits working solely on io_uring.”
io_uring, first launched in Linux kernel model 5.1 in March 2019, is a Linux kernel system name interface that employs two round buffers known as a submission queue (SQ) and a completion queue (CQ) between the kernel and an utility (i.e., person area) to trace the submission and completion of I/O requests in an asynchronous method.
The rootkit devised by ARMO facilitates communication between a command-and-control (C2) server and an contaminated host to fetch instructions and execute them with out making any system calls related to its operations, as an alternative making use of io_uring to realize the identical objectives.
ARMO’s evaluation of at present accessible Linux runtime safety instruments has revealed that each Falco and Tetragon are blind to io_uring-based operations owing to the truth that they’re closely reliant on system name hooking.
The safety dangers posed by io_uring have been recognized for a while. In June 2023, Google revealed that it determined to restrict using the Linux kernel interface throughout Android, ChromeOS, and its manufacturing servers because it “supplies sturdy exploitation primitives.”
“On the one hand, you want visibility into system calls; on the opposite, you want entry to kernel buildings and enough context to detect threats successfully,” Amit Schendel, Head of Safety Analysis at ARMO, stated.
“Many distributors take probably the most easy path: hooking instantly into system calls. Whereas this method affords fast visibility, it comes with limitations. Most notably, system calls aren’t at all times assured to be invoked. io_uring, which may bypass them totally, is a optimistic and nice instance.”
