Linux Has A Blind Spot That Exposes Users To A Nasty Security Flaw

Io_uring was introduced in 2019 with Linux kernel 5.1, and its purpose was to help improve the efficiency and flexibility of input and output operations on Linux. While this led to significant performance gains, it also led to critical blind spots for Linux security tools. Most recently, security researchers have discovered that io_uring operations can completely evade conventional system call monitoring, which suggests that many security solutions cannot detect its activities.

The researchers built a rootkit dubbed Curing. Curing uses only io_uring ops when communicating with the Linux kernel and ultimately it could execute commands, read files, and interact with the network without using any detectable system calls.

When tested against popular open-source and commercial Linux security tools, like Tetragon, Microsoft Defender, and Falco for Endpoint on Linux, the rootkit's activities went completely unnoticed. Falco failed to detect io_uring's actions because of its dependence on intercepting system calls. Tetragon performed slightly better, but detecting io_uring's activities would require custom configurations. Microsoft Defender also missed most of Io_uring's activities. It detected only file changes.


The bigger issue that Linux security faces is that the world has been moving toward lightweight, eBPF-based solutions, mainly focusing on system call monitoring. However, because io_uring can evade system calls, malicious actors can exploit this vulnerability and operate without being noticed.

For organizations looking for quick and effective ways to reduce risk, researchers recommend tracking the behavior of applications with io_uring. If an app that normally doesn't use io_uring suddenly starts doing so, it is a warning sign. The research emphasized the need for Linux security solutions to go beyond system call monitoring to handle modern attack techniques.

If you are a Linux user, researchers suggest that you opt for security solutions that monitor LSM (Linux Security Module) hooks or newer kernel mechanisms like KRSI, which provide deeper insight into kernel activities that io_uring interacts with.