Date: Thu, 21 Apr 2022 16:11:44 +0200 From: Solar Designer <solar@...nwall.com> To: announce@...ts.openwall.com, lkrg-users@...ts.openwall.com Subject: LKRG 0.9.3 Hi, For those new to LKRG, it is a kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel. We've just released LKRG 0.9.3, available on the LKRG project website: https://lkrg.org The following major changes have been made between LKRG 0.9.2 and 0.9.3: *) Support new mainline kernels 5.17.x, 5.18-rc*, and hopefully beyond *) Support loading into Xen PV guest kernels even on older CPUs without UMIP *) Fix build on latest CentOS Stream 8 and upcoming RHEL 8.6+ *) Fix build on CentOS Stream 9 *) Fix build on openSUSE Leap *) Continuous Integration and debugging build updates and improvements At the time of our previous release, LKRG 0.9.2, Linux 5.16-rc* were the latest. We were lucky that it also worked as-is on Linux 5.16.x. However, for compatibility with Linux 5.17+ we promptly made changes to LKRG, which were available in our git repository - and are now in our new release. Under the hood, LKRG grew just a little bit: $ git diff --shortstat v0.9.2..v0.9.3 33 files changed, 252 insertions(+), 69 deletions(-) and got a moderate number of changes, by the following people: $ git shortlog -sn v0.9.2..v0.9.3 11 Vitaly Chikunov 8 Solar Designer 4 Mariusz Zaborski 3 Adam 'pi3' Zabrocki 2 RageLtMan 1 John Helmert III 1 Vladimir D. Seleznev As usual so far, the key changes in this release are Adam's. Notable to our project was Vitaly's ongoing support of the Continuous Integration (adding several more distros) and Mariusz' debugging build updates. Finally, something that should have been in our previous release announcement, but I forgot. I guess better late than never. Last year, Alexander Popov came up with and published a writeup on an LKRG bypass, demonstrated as a modification of his CVE-2021-26708 PoC exploit: https://www.openwall.com/lists/lkrg-users/2021/08/26/1 We greatly appreciate Alexander's work on this. As mentioned on lkrg-users back then, the bypass can be mitigated by setting the sysctl's lkrg.hide=1 and/or kernel.kptr_restrict=2. For now, that's still the case. We're going to look into having LKRG further hide itself and/or hide kernel version specifics, possibly by default. As usual, we welcome any feedback on the lkrg-users mailing list. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.