I read here that any application running in root mode can issue a kernel call and execute in kernel mode. Is is possible that ANY application running in root mode can make a kernel call, go to kernel mode and tamper other program's memory area or mess with the operating system's memory section, cos almost all the tutorial's I find say's that kernel mode gives COMPLETE ACCESS to my hardware, and if it is this way wouldn't that be a great security flaw where the program just after acquiring the root level access would have access to any memory location on RAM/DISK ?
(I have Linux in my mind while I ask this question)
EDIT:
Well i am rreally convinced about the fact that in linux the memory is completely exposed, can someone explain if it is the same way in Windows and Unix
-
It should be the same in Windows. The kernel mode vs user mode distinction is a x86 feature, programs running in Ring 0, i.e. kernel mode, have full privilege over everything, including the memory and MMU.– Lie RyanFeb 3, 2015 at 10:55
2 Answers
Yes, it's certainly possible - many Linux systems even expose memory via the two device files /dev/mem (for physical memory) and /dev/kmem (for virtual memory). You can access the kernel's virtual address space via /proc/kcore. Of course, it's not recommended to write to these devices, as you could easily trash your system.
I'm not sure why this could be considered a security issue, though - you generally have to be root to write to these devices, and if you have root access, you can already do anything you want.
-
-
Other Unix systems may also provide
/dev/memor/dev/kmem, but although Windows used to provide a way to read directly from physical memory calledDevice\PhysicalMemory, it appears to have been disabled in recent versions. You can useReadProcessMemoryto read from the memory space of a single process, though. Nov 5, 2013 at 5:39
You seem to be mixing apples and oranges. To quote the answer to the very question that you reference, “kernel mode and root are two separate ideas that aren’t really related to each other. The concept of running a process as root is a Unix/Linux term that means you're logged in as the administrator of the system. … Any process you run, whether as root or a normal user, generally runs in both user mode and kernel mode.” So an application running as root generally cannot just switch over and start running in kernel mode. All it can do is the same thing a non-root process can do: call a system function, which causes the operating system kernel to run in kernel mode.
That said, it’s true that most Unix-based systems give the root user privileges that are not available to non-root users/processes. For example, as user55325 points out, most Unix-based systems have pseudo-devices like /dev/mem, /dev/kmem, and /proc/kcore that grant privileged processes access to memory that does not belong to them. Also, root processes can kill any process, and can manipulate process in various ways through /proc. And, of course, root has full access to every file. So it’s certainly true that a process that gets root access has a lot of power; but that’s the way it goes.
For that matter, unless you always boot from an optical disc (CD/DVD) or the network, the operating system is stored in disk files, and an attacker who got access to your machine as root could rewrite the entire OS, and then sit back and wait for you to reboot. (And, oh yes, I almost forgot; a root process can reboot your system, too.) So, again, yes, root privilege is very powerful.
