Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 20 Jun 2020 22:38:43 +0200
From: Jacek <>
Subject: Re: Yes, Yes, Yes,p_lkrg has detected dangerous
 exploits. ;)

Hi   Alexander

I cannot reproduce the error at the moment, because after it appeared on
Linux-5.7.4,I updated the lkrg via git pull source, I built the module
again, and these errors do not occur anymore.
On the other hand, I was glad that for the first time I saw the activity
of the p_lkrg module, which I failed earlier despite testing over 30
different exploits.

If someday there are errors in the lkrg action, I will write about them,
for now I thank you for your help and angelic patience.



W dniu 20.06.2020 o 16:42, Solar Designer pisze:
> Hi Jacek,
> On Sat, Jun 20, 2020 at 03:56:22PM +0200, Jacek wrote:
>> Finally p_lkrg revealed its activities, I found the following messages
>> in dmesg:
>> Jun 19 11:57:22 domek kernel: [46870.845646] [p_lkrg] <Exploit
>> Detection> ON process[3619 | thunderbird] has corrupted 'off' flag!
>> Jun 19 11:57:22 domek kernel: [46870.847161] [p_lkrg] <Exploit
>> Detection> Trying to kill process[AudioIPC Server | 3619]!
>> Jun 19 11:57:23 domek kernel: [46872.579300] [p_lkrg] <Exploit
>> Detection> ON process[400 | firefox] has corrupted 'off' flag!
>> Jun 19 11:57:23 domek kernel: [46872.580099] [p_lkrg] <Exploit
>> Detection> Trying to kill process[Cache2 I/O | 400]!
> Ouch.  Are you able to reproduce this?
> Please set log_level=4 (via sysctl or module parameter), so that we have
> more detailed messages next time this occurs.  (That log level is not
> suitable for production use.  Please only use it while we debug this.)
> It could also make sense to try reverting the below commit (which might
> or might not be relevant), but we'd be more interested in having the
> issue reproduced with intact LKRG and verbose logging first, as above.
> commit 8c1a55f7e0105656802d290fc7240c894eb904e0
> Author: Adam_pi3 <>
> Date:   Wed May 13 17:38:19 2020 -0400
>     Improve performance for flag validation
> Thanks,
> Alexander

Content of type "text/html" skipped

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.