New FlipSwitch Hooking Method Overcomes Linux Kernel Defenses

A new rootkit hooking method named FlipSwitch has been identified, circumventing the latest Linux 6.9 kernel dispatch safeguards and raising concerns over kernel-level compromise.

FlipSwitch manipulates the machine code of the new syscall dispatcher instead of the deprecated sys_call_table , enabling stealthy interception of critical system calls such as kill and getdents64 .

Historically, Linux rootkits like Diamorphine exploited the sys_call_table to reroute syscalls through attacker-controlled functions by disabling write protection and overwriting specific entries.

With the release of Linux kernel 6.9, the kernel replaced the direct array lookup with a switch -statement dispatch inside x64_sys_call , rendering modifications to sys_call_table ineffective for syscall handling.

FlipSwitch identifies that the original syscall logic exists in compiled form behind the switch statement. Instead of tampering with sys_call_table , it locates and patches the machine-level call instruction within x64_sys_call that invokes the target syscall function. This process involves:

Discovering the Original Function Address : By reading an entry such as sys_call_table[__NR_kill] , FlipSwitch obtains the address of the original sys_kill routine. Locating kallsyms_lookup_name : FlipSwitch uses a kprobe to find kernel symbols programmatically, bypassing direct exports restrictions. Scanning for the Unique Call Instruction : The x64_sys_call function is searched for the opcode 0xe8 followed by the 4-byte offset that targets sys_kill . Patching the Dispatcher : FlipSwitch disables CPU write protection, overwrites the 4-byte offset of the call instruction, and restores protections after module unload.

FlipSwitch highlights the ongoing dynamic between kernel hardening and adversary innovation. Mitigations may include:

Runtime Integrity Verification : Hashing and validating the machine code of x64_sys_call to detect unauthorized modifications. Enhanced Kprobe Restrictions : Limiting or auditing kprobes for locating critical symbol addresses. Control-Flow Integrity (CFI) : Employing CFI techniques within the kernel to ensure indirect calls match legitimate targets.

Detecting kernel-level rootkits is challenging due to their stealthy operation. Elastic Security has published a YARA rule targeting the FlipSwitch proof-of-concept, scanning for unique machine-code patterns introduced during the patching process:

rule Linux_Rootkit_Flipswitch_821f3c9e { meta: author = "Elastic Security" description = "Detect FlipSwitch rootkit PoC" os = "Linux" arch = "x86" strings: $all_a = { FF FF 48 89 45 E8 F0 80 ?? ?? ?? } $main_b = { 41 54 53 E8 ?? ?? ?? ?? 48 C7 C7 ?? ?? ?? ?? } condition: #all_a >= 2 and 1 of ($main_b) }

Deploying this rule in memory-scanning tools can help flag FlipSwitch’s patched dispatcher for timely response.

Based on reporting by GBHackers.