Security researchers at ARMO have unveiled a proof-of-concept rootkit called “Curing” that exploits a significant vulnerability in Linux security monitoring. The rootkit leverages io_uring—an asynchronous I/O mechanism introduced in Linux kernel 5.1 (2019)—to evade detection by traditional security tools.

## How io_uring Creates a Security Gap

The io_uring interface uses two circular buffers (submission queue and completion queue) to handle I/O requests between the kernel and applications without requiring traditional system calls. This architecture creates what ARMO describes as “a major blind spot in Linux runtime security tools.”

The Curing rootkit demonstrates this vulnerability by establishing communication with a command-and-control server and executing malicious commands while completely bypassing system call monitoring—the very mechanism most security tools rely on for threat detection.

## Impact on Security Tools

ARMO’s research revealed concerning limitations in popular Linux security solutions:

– **Falco and Tetragon**: Both tools are completely blind to io_uring-based operations due to their reliance on system call hooking
– **CrowdStrike Falcon**: Initially vulnerable but has since implemented a fix
– **Microsoft Defender for Endpoint on Linux**: Lacks detection capabilities for various threats regardless of io_uring usage

## Known Risk

The security community has been aware of io_uring’s potential risks. Google acknowledged these concerns in June 2023, restricting the interface’s use across Android, ChromeOS, and production servers due to its “strong exploitation primitives.”

As Amit Schendel, Head of Security Research at ARMO, explains: “Many vendors take the most straightforward path: hooking directly into system calls. While this approach offers quick visibility, it comes with limitations. Most notably, system calls aren’t always guaranteed to be invoked. io_uring, which can bypass them entirely, is a positive and great example.”