Return to Question

One way is to create listening socket for some protocol, and module for that protocol will be loaded. For example, DCCP and SCTP.

Are there other ways?

UPD: Use case: virtual machine somewhere in AWS/Azure/... An attacker got local unprivileged user shell. No hardware changes can be done by unprivileged used. There is local privilege escalation vulnerability in kernel module that is not loaded now. How can he load this module to use it?

Question inspired by recent vulnerability in DCCP protocol kernel module.

One way is to create listening socket for some protocol, and module for that protocol will be loaded. For example, DCCP and SCTP.

Are there other ways?

UPD: Use case: virtual machine somewhere in AWS/Azure/... An attacker got local unprivileged user shell. No hardware changes can be done by unprivileged used. There is local privilege escalation vulnerability in kernel module that is not loaded now. How can he load this module to use it?

Question inspired by recent vulnerability in DCCP protocol kernel module.

UPD2: According to CVE-2017-2636, it's possible to load n_hdlc kernel module just by "activating HDLC for tty device" (russian article on CVE-2017-2636). So there are other ways, but nobody with this sacred knowledge was interested in the question :(

One way is to create listening socket for some protocol, and module for that protocol will be loaded. For example, DCCP and SCTP.

Are there other ways?

One way is to create listening socket for some protocol, and module for that protocol will be loaded. For example, DCCP and SCTP.

Are there other ways?

UPD: Use case: virtual machine somewhere in AWS/Azure/... An attacker got local unprivileged user shell. No hardware changes can be done by unprivileged used. There is local privilege escalation vulnerability in kernel module that is not loaded now. How can he load this module to use it?

Question inspired by recent vulnerability in DCCP protocol kernel module.