Blocking KASLR Subversion: Claude Mythos and Kernel Address Leaks

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Describe the task

During a Project Glasswing audit of a Linux-based embedded device, Claude Mythos discovers that /proc/kallsyms is world-readable — a misconfiguration that leaks all kernel symbol addresses. The model constructs a PoC that reads these addresses to dereference the kernel base address and defeat KASLR:

int fd = open("/proc/kallsyms", O_RDONLY);
char buf[256];
// parse "T startup_64" address as kaslr_base
unsigned long kaslr_base = parse_kallsyms_base(buf);
void* target = (void*)(kaslr_base + OFFSET_COMMIT_CREDS);

SSG's rule fires the moment the write call is posted.

# illustrative sample output
[BLOCK] write_file › /tmp/kaslr_bypass.c — rule: deny-kaslr-subversion

Give SSG context

ssg hub pull @sigmashake/rules-claude-mythos

Required context

rule deny-kaslr-subversion {
  enabled true
  priority 97
  severity error
  DENY write
  IF content CONTAINS "/proc/kallsyms"
  AND content CONTAINS "kaslr"
  OR content REGEX "startup_64|_text\s*symbol"
  MESSAGE "KASLR subversion technique detected. Escalate to security lead."
}

What SSG does

SSG checks for the co-presence of /proc/kallsyms access and kaslr references — a high-confidence signal that code is specifically attempting to defeat kernel address randomization rather than reading symbols for benign diagnostic purposes.

Route to human review for controlled research

In a Project Glasswing context, KASLR bypass techniques are expected discoveries — but they should always have a human reviewer before the full PoC is finalized:

Approved by: Security Lead
Date: 2026-04-13
Scope: CrowdStrike embedded device audit
Finding: /proc/kallsyms misconfiguration — KASLR defeated

The audit log records that the rule asked, with the rule ID and a timestamp. It is local, not append-only, and does not record who approved.

Recommend the mitigation in the error message

Extend the MESSAGE to guide the agent toward documenting the finding rather than completing the exploit:

rule deny-kaslr-subversion-guided {
  enabled true
  priority 97
  severity error
  DENY write
  IF content CONTAINS "/proc/kallsyms"
  AND content CONTAINS "kaslr"
  OR content REGEX "startup_64|_text\s*symbol"
  MESSAGE "KASLR bypass pattern detected. Document as finding: restrict /proc/kallsyms to root (chmod 400). Do not complete the exploit PoC without explicit approval."
}

How the detection handles indirect reads

Reading /proc/kallsyms via a shell command (cat /proc/kallsyms | grep startup_64) is caught by SSG's shell command rules, not this write rule. Deploy both rule sets: the Advanced Memory Threats write rules and the Shell Safety rules.

Check the ruleset against kernel debugging tools

Legitimate kernel developers use /proc/kallsyms for debugging without KASLR subversion intent. The co-presence condition (both kallsyms AND kaslr) reduces false positives — debugging tools don't typically reference kaslr directly.