Cybersecurity researchers have demonstrated a proof-of-concept (PoC) rootkit dubbed Curing that leverages a Linux asynchronous I/O mechanism known as io_uring to bypass conventional system name monitoring.
This causes a “main blind spot in Linux runtime safety instruments,” ARMO mentioned.
“This mechanism permits a consumer utility to carry out numerous actions with out utilizing system calls,” the corporate mentioned in
Linux io_uring PoC Rootkit Bypasses System Name-Based mostly Risk Detection Instruments
