Cybersecurity researchers have demonstrated a proof-of-concept (PoC) rootkit dubbed Curing that leverages a Linux asynchronous I/O mechanism known as io_uring to bypass conventional system name monitoring.
This causes a “main blind spot in Linux runtime safety instruments,” ARMO mentioned.
“This mechanism permits a consumer utility to carry out varied actions with out utilizing system calls,” the corporate mentioned in a report shared with The Hacker Information. “Consequently, safety instruments counting on system name monitoring are blind’ to rootkits working solely on io_uring.”
io_uring, first launched in Linux kernel model 5.1 in March 2019, is a Linux kernel system name interface that employs two round buffers known as a submission queue (SQ) and a completion queue (CQ) between the kernel and an utility (i.e., consumer area) to trace the submission and completion of I/O requests in an asynchronous method.
The rootkit devised by ARMO facilitates communication between a command-and-control (C2) server and an contaminated host to fetch instructions and execute them with out making any system calls related to its operations, as a substitute making use of io_uring to attain the identical objectives.
ARMO’s evaluation of at the moment obtainable Linux runtime safety instruments has revealed that each Falco and Tetragon are blind to io_uring-based operations owing to the truth that they’re closely reliant on system name hooking.
The safety dangers posed by io_uring have been recognized for a while. In June 2023, Google revealed that it determined to restrict the usage of the Linux kernel interface throughout Android, ChromeOS, and its manufacturing servers because it “supplies sturdy exploitation primitives.”
“On the one hand, you want visibility into system calls; on the opposite, you want entry to kernel buildings and adequate context to detect threats successfully,” Amit Schendel, Head of Safety Analysis at ARMO, mentioned.
“Many distributors take probably the most simple path: hooking straight into system calls. Whereas this strategy gives fast visibility, it comes with limitations. Most notably, system calls aren’t all the time assured to be invoked. io_uring, which may bypass them fully, is a optimistic and nice instance.”