LKRG retweeted
Openwall@Openwall
Apr 25
Linux Kernel Runtime Guard @lkrg_org 1.0.1 by @Adam_pi3 @solardiz @kerneltoast et al. is out, adds support for Linux 6.19 and 7.0, contains hardening changes and bug fixes openwall.com/lists/announce…
0
10
20
3,865
LKRG retweeted
Openwall@Openwall
20 Sep 2025
We've just published the slides of @solardiz's @nullcon Berlin 2025 talk "Linux Kernel Runtime Guard (LKRG) 1.0" openwall.com/lists/announce… #LKRG #nullconBerlin2025 #nullcon
What is LKRG - Project of Adam 'pi3' Zabrocki - Brought under Openwall umbrella for its first public release in 2018 - (Post-)detection of (and response to) kernel rootkits and exploits - Linux kernel module that performs - Runtime integrity checking of the *kernel* and *modules* (including itself) <- "code" - and of *CPU* flags and *globals* and the kernel's view of running *processes* <- "data" - Sanity-checking of *control flow* (stack unwinding) and blocking some APIs - Response to (almost-)successful attacks and encrypted remote logging - 20+ contributors total, 4 very active this release cycle (0.9.9 to 1.0.0) - Also users contribute testing beyond what we could perform ourselves - Independent project with some corporate support - Remote logging research and initial implementation in 2022 by Binarly - Many general improvements, releases, packaging in 2023-2025 by CIQ
0
18
38
9,072
LKRG retweeted
Phoronix
@phoronix
5 Sep 2025
Linux Kernel Runtime Guard 1.0 Released For Security Vulnerability Exploit Detection

phoronix.com/news/LKRG-1.0-…
0
7
33
2,912
LKRG retweeted
Openwall@Openwall
2 Sep 2025
Linux Kernel Runtime Guard @lkrg_org 1.0.0 by @Adam_pi3 @solardiz @kerneltoast et al. is out, adds support for Linux 6.13+ (tested to 6.17-rc4), forward-edge CFI (Intel CET IBT, KCFI), ..., reduces performance overhead, shrinks the codebase by ~2500 lines. openwall.com/lists/announce…
CIQ
@CtrlIQ
29 Aug 2025
Heading to Nullcon Berlin 2025? @solardiz will share his LKRG expertise by taking an in-depth look at kernel hardening challenges and what it takes to protect systems in the real world.

nullcon.net/berlin-2025/sp…

#NullconBerlin2025 #LinuxSecurity #RLC_H
0
8
20
2,991
LKRG retweeted
NULLCON@nullcon
10 Aug 2025
🧑‍🍳🍽️ If your OS were a restaurant, #LKRG would be the invisible food inspector—checking for tampering in real time.

Join Solar Designer at #NullconBerlin2025 as he unpacks how LKRG grew from a bold idea to a powerful #Linux kernel #security tool.

👉 nullcon.net/berlin-2025/sp…
0
1
4
624
LKRG retweeted
CIQ
@CtrlIQ
30 Jul 2025
What happens when attackers reach your Linux kernel?

The Linux Kernel Runtime Guard (LKRG) continuously monitors kernel integrity in real-time, detecting exploits as they happen - including zero-days that other security measures miss.

Key features:
• Runtime integrity xploit detection
• Minimal performance impact (2.5%)
• No reboot required for deployment

Read our technical brief written by Solar Designer (@solardiz): hubs.li/Q03zDVFb0

#LinuxSecurity #KernelSecurity #CyberSecurity #LKRG
0
5
7
1,465
LKRG retweeted
NULLCON@nullcon
29 Jul 2025
At #NullconBerlin2025, @solardiz will walk us through the journey from LKRG’s edgy debut to its 1.0 release – complete with real-world attacks, trade-offs, nasty bugs, &amp; some honest truths about kernel hardening.

Know More: nullcon.net/berlin-2025/sp…

#LKRG #LinuxSecurity
1
6
14
3,147
LKRG retweeted
CIQ
@CtrlIQ
23 Apr 2025
🔒 Enhancing LKRG: A Step Toward Stronger Security. CIQ's own Sultan Alsawaf recently contributed impactful updates to the LKRG project, fixing longstanding bugs & making it stronger & more stable than ever.

Learn more here 🔗 hubs.li/Q03jDBsj0

#HPC #IT#HPCR#ITO#LKRGurce #Linux
0
6
7
1,617
LKRG retweeted
Adam 'pi3' Zabrocki
@Adam_pi3
11 Mar 2025
Hardened Rocky Linux from CIQ is shipped with LKRG (@lkrg_org)!
Solar Designer@solardiz
11 Mar 2025
I'm happy to build upon and extend the ideas and approaches we had tested and proven, and expertise gained building @Openwall's security enhanced Linux distribution, now for @CtrlIQ's wider audience and in a modern context.
0
5
25
9,640
LKRG retweeted
Openwall@Openwall
23 Oct 2024
Linux Kernel Runtime Guard @lkrg_org 0.9.9 by @Adam_pi3 et al. is out, adds support for Linux 6.11+, 6.10.10+, 5.10.220+, CentOS Stream 9 (upcoming RHEL 9.5). openwall.com/lists/announce…
Updated packages for Rocky Linux 9.4 and 8.10 being released sig-security.rocky.page/packages/lkrg/ @rocky_linux
1
5
19
2,808
LKRG retweeted
cr0@Defensive-Security.com / EDRmetry / PurpleLabs
@cr0nym
11 Apr 2024
Linux kernel "GSM" exploit vs LKRG 🔥@lkrg_org
0
3
17
1,333
LKRG retweeted
Solar Designer@solardiz
28 Mar 2024
This particular exploit (but not the vulnerability!) is prevented by @lkrg_org's usermodehelper allow list. Just tested on Rocky Linux 9.3 with SIG/Security package of LKRG - exploit stuck at "[*] overwriting path with PIDs in range 0-&gt;4194304..." &amp; the expected LKRG alert flood.
Lau@notselwyn
26 Mar 2024
Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵

pwning.tech/nftables
2
10
29
6,161
LKRG retweeted
Openwall@Openwall
4 Mar 2024
Slides of @solardiz's talk "Linux kernel remote logging: approaches, challenges, implementation" from @BSidesZagreb openwall.com/lists/announce…
The talk also included live demo of LKRG @lkrg_org catching @chompie1337's CVE-2021-3490 exploit and logging this event on another continent
1
9
18
8,660
LKRG retweeted
Openwall@Openwall
28 Feb 2024
Linux Kernel Runtime Guard (LKRG) 0.9.8 by @Adam_pi3 et al. is out, adding a remote kernel message logging capability sponsored by @binarly_io. openwall.com/lists/announce…
This update is already packaged for Rocky Enterprise Linux 8.9 and 9.3 @rocky_linux. sig-security.rocky.page/packages/lkrg/
1
12
26
5,791
LKRG retweeted
Adam 'pi3' Zabrocki
@Adam_pi3
8 Oct 2023
LKRG: @rocky_linux announced a Special Interest Group (SIG) focused on Security and, among others, adds Linux Kernel Runtime Guard (@lkrg_org) package:

rockylinux.org/pl/news/securi…

CC: @solardiz
0
3
14
2,360
LKRG retweeted
cr0@Defensive-Security.com / EDRmetry / PurpleLabs
@cr0nym
5 Oct 2023
[1] Don't need Linux User Mode Helper? Block it with LKRG!

User mode helper (UMH) is a feature in the Linux kernel that allows user-level processes to execute code in kernel mode with the assistance of a privileged helper program.
LKRG performs runtime integrity checking of...
2
2
7
1,622
LKRG retweeted
cr0@Defensive-Security.com / EDRmetry / PurpleLabs
@cr0nym
27 Sep 2023
Replying to @cr0nym
[5] LKRG for pre and post-incident, here vs reptile rootkit and vs usermodehelper execution
1
7
26
4,861
LKRG retweeted
Openwall@Openwall
14 Sep 2023
Linux Kernel Runtime Guard (LKRG) 0.9.7 by @Adam_pi3 et al. is out, adding support for Linux 6.4 to 6.5.x and hopefully beyond, as well as for new RHEL 9.1 and 9.2 kernels. openwall.com/lists/announce…
0
7
18
2,684
LKRG@lkrg_org
14 Dec 2022
Linux Kernel Runtime Guard (LKRG) 0.9.6 by @Adam_pi3 et al. is out, adding support for Linux 6.1, RHEL 8.7, current CentOS Stream 9 (upcoming RHEL 9.2), along with a variety of other changes for portability, robustness, and extra security checks. openwall.com/lists/announce…
0
15
12
LKRG retweeted
Red Canary, a Zscaler company
@redcanary
24 Aug 2022
Replying to @redcanary
We recommend using a tool called Linux Kernel Runtime Guard (LKRG) which is a kernel module that performs kernel integrity checks to help detect and identify vulnerabilities and exploits.
1
11
17
Load more