From: Andy Lutomirski <luto@kernel.org>
To: Paul Burton <paul.burton@mips.com>
Cc: Andy Lutomirski <luto@kernel.org>,
Linux MIPS Mailing List <linux-mips@linux-mips.org>,
LKML <linux-kernel@vger.kernel.org>,
Paul Burton <paul.burton@imgtec.com>,
David Daney <david.daney@cavium.com>,
Ralf Baechle <ralf@linux-mips.org>,
James Hogan <jhogan@kernel.org>, Rich Felker <dalias@libc.org>
Subject: Re: Fixing MIPS delay slot emulation weakness?
Date: Sun, 16 Dec 2018 10:55:48 -0800 [thread overview]
Message-ID: <CALCETrW49AdvgFrKkFaMtfaFcUDGGDykLDZoCH93utxe5pmPDQ@mail.gmail.com> (raw)
In-Reply-To: <20181215212643.sfk2zwzatdfysbk3@pburton-laptop>
On Sun, Dec 16, 2018 at 1:22 AM Paul Burton <paul.burton@mips.com> wrote:
>
> Hi Andy,
>
> On Sat, Dec 15, 2018 at 11:19:37AM -0800, Andy Lutomirski wrote:
> > Some security researchers pointed out that writing to the delay slot
> > emulation page is a great exploit technique on MIPS. It was
> > introduced in:
> >
> > commit 432c6bacbd0c16ec210c43da411ccc3855c4c010
> > Author: Paul Burton <paul.burton@imgtec.com>
> > Date: Fri Jul 8 11:06:19 2016 +0100
> >
> > MIPS: Use per-mm page to execute branch delay slot instructions
>
> Are there any further details you can share? You'd still need to
> persuade a program to both write to & jump to the page, right? We're
> talking purely about this providing writable+executable memory?
Yes, exactly. You need a bug in order to take advantage of it. The
RWX page at a known location just makes exploitation considerably
easier.
I should also note that, on x86 at least, emulating loads and stores
is not so bad. The x86 vsyscall emulation code does it and has almost
fully correct fault semantics. (I say "almost" because I didn't
bother getting the semantics exactly right for non-canonical addresses
and kernel addresses.)
next prev parent reply other threads:[~2018-12-16 18:56 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-15 19:19 Fixing MIPS delay slot emulation weakness? Andy Lutomirski
2018-12-15 21:26 ` Paul Burton
2018-12-16 18:11 ` Rich Felker
2018-12-16 18:55 ` Andy Lutomirski [this message]
2018-12-15 22:50 ` Rich Felker
2018-12-16 2:15 ` Maciej W. Rozycki
2018-12-16 2:32 ` Rich Felker
2018-12-16 13:50 ` Maciej W. Rozycki
2018-12-16 18:13 ` Rich Felker
2018-12-16 18:59 ` Andy Lutomirski
2018-12-16 19:45 ` Maciej W. Rozycki
2018-12-17 0:59 ` Rich Felker
2018-12-17 1:55 ` Maciej W. Rozycki
2018-12-18 1:13 ` Aaro Koskinen
2018-12-19 4:32 ` Paul Burton
2018-12-19 21:12 ` Hugh Dickins
2018-12-20 17:56 ` Paul Burton
2018-12-20 17:45 ` [PATCH] MIPS: math-emu: Write-protect delay slot emulation pages Paul Burton
[not found] ` <20181220192616.42976218FE@mail.kernel.org>
2018-12-21 21:16 ` Paul Burton
2018-12-22 19:16 ` Sasha Levin
2018-12-23 16:16 ` Paul Burton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CALCETrW49AdvgFrKkFaMtfaFcUDGGDykLDZoCH93utxe5pmPDQ@mail.gmail.com \
--to=luto@kernel.org \
--cc=dalias@libc.org \
--cc=david.daney@cavium.com \
--cc=jhogan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@linux-mips.org \
--cc=paul.burton@imgtec.com \
--cc=paul.burton@mips.com \
--cc=ralf@linux-mips.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.