Researchers Reveal Linux Security Flaw Using io_uring Exploited by Curing Rootkit

ARMO, the cybersecurity firm behind Kubescape, has revealed a critical vulnerability in Linux systems involving the io_uring interface, a kernel feature designed for efficient I/O operations. In a groundbreaking demonstration, ARMO developed a proof-of-concept rootkit called ‘Curing’ that stealthily bypasses many existing Linux security tools, including those relying on eBPF (Extended Berkeley Packet Filter) technologies. This rootkit exploits the fact that most modern detection systems monitor system calls, yet io_uring can perform many actions outside this scope, creating a blind spot in traditional monitoring strategies. As a result, malicious actors can perform unauthorized file manipulation or network connections without being detected. The issue is especially troubling for cloud-native environments where Linux is widely used. Although io_uring has been in the kernel for several years, this is the first known public release of a working rootkit that uses it for evasion. ARMO’s CADR (Cloud Application Detection & Response) solution offers a potential mitigation by allowing users to disable unused system calls like io_uring. The discovery urges Linux users and security professionals to reassess their reliance on conventional system call monitoring and adapt to new threat vectors introduced by kernel-level features like io_uring.