Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. 

VDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).(Citation: ELF Injection May 2009)(Citation: Backtrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 2014)

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process.  
VDSO Hijacking
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1055/014  external_id: T1055.014     source_name: Backtrace VDSO  description: backtrace. (2016, April 22). ELF SHARED LIBRARY INJECTION FORENSICS. Retrieved June 15, 2020.  url: https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/     source_name: Syscall 2014  description: Drysdale, D. (2014, July 16). Anatomy of a system call, part 2. Retrieved June 16, 2020.  url: https://lwn.net/Articles/604515/     source_name: GNU Acct  description: GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved December 20, 2017.  url: https://www.gnu.org/software/acct/     source_name: RHEL auditd  description: Jahoda, M. et al.. (2017, March 14). redhat Security Guide - Chapter 7 - System Auditing. Retrieved December 20, 2017.  url: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing     source_name: ArtOfMemoryForensics  description: Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved December 20, 2017.     source_name: ELF Injection May 2009  description: O'Neill, R. (2009, May). Modern Day ELF Runtime infection via GOT poisoning. Retrieved March 15, 2020.  url: https://web.archive.org/web/20150711051625/http://vxer.org/lib/vrn00.html     source_name: VDSO Aug 2005  description: Petersson, J. (2005, August 14). What is linux-gate.so.1?. Retrieved June 16, 2020.  url: https://web.archive.org/web/20051013084246/http://www.trilithium.com/johan/2005/08/linux-gate/     source_name: Chokepoint preload rootkits  description: stderr. (2014, February 14). Detecting Userland Preload Rootkits. Retrieved December 20, 2017.  url: http://www.chokepoint.net/2014/02/detecting-userland-preload-rootkits.html     