From: Kees Cook <keescook@chromium.org> To: linux-kernel@vger.kernel.org Cc: Kees Cook <keescook@chromium.org>, Andy Lutomirski <luto@amacapital.net>, Ingo Molnar <mingo@redhat.com>, Thomas Gleixner <tglx@linutronix.de>, "H. Peter Anvin" <hpa@zytor.com>, x86@kernel.org, Arnd Bergmann <arnd@arndb.de>, Michael Ellerman <mpe@ellerman.id.au>, linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH 2/2] x86, vdso: mark vDSO read-only after init Date: Tue, 24 Nov 2015 13:38:34 -0800 [thread overview] Message-ID: <1448401114-24650-3-git-send-email-keescook@chromium.org> (raw) In-Reply-To: <1448401114-24650-1-git-send-email-keescook@chromium.org> The vDSO does not need to be writable after __init, so mark it as __read_only. The result kills the exploit method of writing to the vDSO from kernel space resulting in userspace executing the modified code, as shown here to bypass SMEP restrictions: http://itszn.com/blog/?p=21 The memory map (with added vDSO address reporting) shows the vDSO moving into read-only memory: Before: [ 0.143067] vDSO @ ffffffff82004000 [ 0.143551] vDSO @ ffffffff82006000 ---[ High Kernel Mapping ]--- 0xffffffff80000000-0xffffffff81000000 16M pmd 0xffffffff81000000-0xffffffff81800000 8M ro PSE GLB x pmd 0xffffffff81800000-0xffffffff819f3000 1996K ro GLB x pte 0xffffffff819f3000-0xffffffff81a00000 52K ro NX pte 0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd 0xffffffff81e00000-0xffffffff81e05000 20K ro GLB NX pte 0xffffffff81e05000-0xffffffff82000000 2028K ro NX pte 0xffffffff82000000-0xffffffff8214f000 1340K RW GLB NX pte 0xffffffff8214f000-0xffffffff82281000 1224K RW NX pte 0xffffffff82281000-0xffffffff82400000 1532K RW GLB NX pte 0xffffffff82400000-0xffffffff83200000 14M RW PSE GLB NX pmd 0xffffffff83200000-0xffffffffc0000000 974M pmd After: [ 0.145062] vDSO @ ffffffff81da1000 [ 0.146057] vDSO @ ffffffff81da4000 ---[ High Kernel Mapping ]--- 0xffffffff80000000-0xffffffff81000000 16M pmd 0xffffffff81000000-0xffffffff81800000 8M ro PSE GLB x pmd 0xffffffff81800000-0xffffffff819f3000 1996K ro GLB x pte 0xffffffff819f3000-0xffffffff81a00000 52K ro NX pte 0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd 0xffffffff81e00000-0xffffffff81e0b000 44K ro GLB NX pte 0xffffffff81e0b000-0xffffffff82000000 2004K ro NX pte 0xffffffff82000000-0xffffffff8214c000 1328K RW GLB NX pte 0xffffffff8214c000-0xffffffff8227e000 1224K RW NX pte 0xffffffff8227e000-0xffffffff82400000 1544K RW GLB NX pte 0xffffffff82400000-0xffffffff83200000 14M RW PSE GLB NX pmd 0xffffffff83200000-0xffffffffc0000000 974M pmd Based on work by Brad Spengler. Signed-off-by: Kees Cook <keescook@chromium.org> --- arch/x86/entry/vdso/vdso2c.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h index 0224987556ce..677ce3ac4d34 100644 --- a/arch/x86/entry/vdso/vdso2c.h +++ b/arch/x86/entry/vdso/vdso2c.h @@ -140,7 +140,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len, fprintf(outfile, "#include <asm/vdso.h>\n"); fprintf(outfile, "\n"); fprintf(outfile, - "static unsigned char raw_data[%lu] __page_aligned_data = {", + "static unsigned char raw_data[%lu] __read_only __aligned(PAGE_SIZE) = {", mapping_size); for (j = 0; j < stripped_len; j++) { if (j % 10 == 0) @@ -150,7 +150,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len, } fprintf(outfile, "\n};\n\n"); - fprintf(outfile, "static struct page *pages[%lu];\n\n", + fprintf(outfile, "static struct page *pages[%lu] __read_only;\n\n", mapping_size / 4096); fprintf(outfile, "const struct vdso_image %s = {\n", name); -- 1.9.1
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org> To: linux-kernel@vger.kernel.org Cc: Kees Cook <keescook@chromium.org>, Andy Lutomirski <luto@amacapital.net>, Ingo Molnar <mingo@redhat.com>, Thomas Gleixner <tglx@linutronix.de>, "H. Peter Anvin" <hpa@zytor.com>, x86@kernel.org, Arnd Bergmann <arnd@arndb.de>, Michael Ellerman <mpe@ellerman.id.au>, linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [kernel-hardening] [PATCH 2/2] x86, vdso: mark vDSO read-only after init Date: Tue, 24 Nov 2015 13:38:34 -0800 [thread overview] Message-ID: <1448401114-24650-3-git-send-email-keescook@chromium.org> (raw) In-Reply-To: <1448401114-24650-1-git-send-email-keescook@chromium.org> The vDSO does not need to be writable after __init, so mark it as __read_only. The result kills the exploit method of writing to the vDSO from kernel space resulting in userspace executing the modified code, as shown here to bypass SMEP restrictions: http://itszn.com/blog/?p=21 The memory map (with added vDSO address reporting) shows the vDSO moving into read-only memory: Before: [ 0.143067] vDSO @ ffffffff82004000 [ 0.143551] vDSO @ ffffffff82006000 ---[ High Kernel Mapping ]--- 0xffffffff80000000-0xffffffff81000000 16M pmd 0xffffffff81000000-0xffffffff81800000 8M ro PSE GLB x pmd 0xffffffff81800000-0xffffffff819f3000 1996K ro GLB x pte 0xffffffff819f3000-0xffffffff81a00000 52K ro NX pte 0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd 0xffffffff81e00000-0xffffffff81e05000 20K ro GLB NX pte 0xffffffff81e05000-0xffffffff82000000 2028K ro NX pte 0xffffffff82000000-0xffffffff8214f000 1340K RW GLB NX pte 0xffffffff8214f000-0xffffffff82281000 1224K RW NX pte 0xffffffff82281000-0xffffffff82400000 1532K RW GLB NX pte 0xffffffff82400000-0xffffffff83200000 14M RW PSE GLB NX pmd 0xffffffff83200000-0xffffffffc0000000 974M pmd After: [ 0.145062] vDSO @ ffffffff81da1000 [ 0.146057] vDSO @ ffffffff81da4000 ---[ High Kernel Mapping ]--- 0xffffffff80000000-0xffffffff81000000 16M pmd 0xffffffff81000000-0xffffffff81800000 8M ro PSE GLB x pmd 0xffffffff81800000-0xffffffff819f3000 1996K ro GLB x pte 0xffffffff819f3000-0xffffffff81a00000 52K ro NX pte 0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd 0xffffffff81e00000-0xffffffff81e0b000 44K ro GLB NX pte 0xffffffff81e0b000-0xffffffff82000000 2004K ro NX pte 0xffffffff82000000-0xffffffff8214c000 1328K RW GLB NX pte 0xffffffff8214c000-0xffffffff8227e000 1224K RW NX pte 0xffffffff8227e000-0xffffffff82400000 1544K RW GLB NX pte 0xffffffff82400000-0xffffffff83200000 14M RW PSE GLB NX pmd 0xffffffff83200000-0xffffffffc0000000 974M pmd Based on work by Brad Spengler. Signed-off-by: Kees Cook <keescook@chromium.org> --- arch/x86/entry/vdso/vdso2c.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h index 0224987556ce..677ce3ac4d34 100644 --- a/arch/x86/entry/vdso/vdso2c.h +++ b/arch/x86/entry/vdso/vdso2c.h @@ -140,7 +140,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len, fprintf(outfile, "#include <asm/vdso.h>\n"); fprintf(outfile, "\n"); fprintf(outfile, - "static unsigned char raw_data[%lu] __page_aligned_data = {", + "static unsigned char raw_data[%lu] __read_only __aligned(PAGE_SIZE) = {", mapping_size); for (j = 0; j < stripped_len; j++) { if (j % 10 == 0) @@ -150,7 +150,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len, } fprintf(outfile, "\n};\n\n"); - fprintf(outfile, "static struct page *pages[%lu];\n\n", + fprintf(outfile, "static struct page *pages[%lu] __read_only;\n\n", mapping_size / 4096); fprintf(outfile, "const struct vdso_image %s = {\n", name); -- 1.9.1
next prev parent reply other threads:[~2015-11-24 21:41 UTC|newest] Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-11-24 21:38 [PATCH 0/2] introduce post-init read-only memory Kees Cook 2015-11-24 21:38 ` [kernel-hardening] " Kees Cook 2015-11-24 21:38 ` [PATCH 1/2] x86: " Kees Cook 2015-11-24 21:38 ` [kernel-hardening] " Kees Cook 2015-11-25 0:34 ` Andy Lutomirski 2015-11-25 0:34 ` [kernel-hardening] " Andy Lutomirski 2015-11-25 0:34 ` Andy Lutomirski 2015-11-25 0:44 ` Kees Cook 2015-11-25 0:44 ` [kernel-hardening] " Kees Cook 2015-11-25 0:44 ` Kees Cook 2015-11-25 0:54 ` [kernel-hardening] " Michael Ellerman 2015-11-25 15:03 ` Kees Cook 2015-11-25 15:03 ` Kees Cook 2015-11-25 23:05 ` Michael Ellerman 2015-11-25 23:32 ` Kees Cook 2015-11-25 23:32 ` Kees Cook 2015-11-25 23:32 ` Kees Cook 2015-11-24 21:38 ` Kees Cook [this message] 2015-11-24 21:38 ` [kernel-hardening] [PATCH 2/2] x86, vdso: mark vDSO read-only after init Kees Cook 2015-11-25 9:13 ` [kernel-hardening] [PATCH 0/2] introduce post-init read-only memory Mathias Krause 2015-11-25 9:13 ` Mathias Krause 2015-11-25 10:06 ` [kernel-hardening] " Clemens Ladisch 2015-11-25 11:14 ` PaX Team 2015-11-25 11:14 ` PaX Team 2015-11-26 15:23 ` [kernel-hardening] " Daniel Micay 2015-11-25 11:05 ` PaX Team 2015-11-25 11:05 ` PaX Team 2015-11-26 8:54 ` [kernel-hardening] " Ingo Molnar 2015-11-26 9:57 ` PaX Team 2015-11-26 9:57 ` PaX Team 2015-11-26 10:42 ` [kernel-hardening] " Ingo Molnar 2015-11-26 12:14 ` PaX Team 2015-11-26 12:14 ` PaX Team 2015-11-27 8:05 ` [kernel-hardening] " Ingo Molnar 2015-11-27 8:05 ` Ingo Molnar 2015-11-27 15:29 ` [kernel-hardening] " PaX Team 2015-11-27 15:29 ` PaX Team 2015-11-27 16:30 ` [kernel-hardening] " Andy Lutomirski 2015-11-27 16:30 ` Andy Lutomirski 2015-11-29 8:08 ` Ingo Molnar 2015-11-29 11:15 ` PaX Team 2015-11-29 11:15 ` PaX Team 2015-11-29 15:39 ` [kernel-hardening] " Ingo Molnar 2015-11-29 18:05 ` Mathias Krause 2015-11-29 18:05 ` Mathias Krause 2015-11-30 8:01 ` [kernel-hardening] " Ingo Molnar 2015-11-30 8:01 ` Ingo Molnar 2015-11-26 16:11 ` [kernel-hardening] " Andy Lutomirski 2015-11-26 16:11 ` Andy Lutomirski 2015-11-26 16:11 ` Andy Lutomirski 2015-11-27 7:59 ` [kernel-hardening] " Ingo Molnar 2015-11-27 7:59 ` Ingo Molnar 2015-11-27 7:59 ` Ingo Molnar 2015-11-27 18:00 ` [kernel-hardening] " Linus Torvalds 2015-11-27 18:00 ` Linus Torvalds 2015-11-27 18:03 ` Linus Torvalds 2015-11-27 18:03 ` Linus Torvalds 2015-11-27 18:03 ` Linus Torvalds 2015-11-27 20:03 ` [kernel-hardening] " Kees Cook 2015-11-27 20:03 ` Kees Cook 2015-11-27 20:03 ` Kees Cook 2015-11-27 20:09 ` [kernel-hardening] " Andy Lutomirski 2015-11-27 20:09 ` Andy Lutomirski 2015-11-29 8:05 ` Ingo Molnar 2015-11-29 8:05 ` Ingo Molnar 2015-11-30 21:14 ` H. Peter Anvin 2015-11-30 21:14 ` H. Peter Anvin 2015-11-30 21:14 ` H. Peter Anvin 2015-11-30 21:33 ` [kernel-hardening] " Kees Cook 2015-11-30 21:33 ` Kees Cook 2015-11-30 21:38 ` Andy Lutomirski 2015-11-30 21:38 ` Andy Lutomirski 2015-11-30 21:43 ` H. Peter Anvin 2015-11-30 21:43 ` H. Peter Anvin 2015-11-30 21:43 ` H. Peter Anvin 2015-11-25 17:26 ` [kernel-hardening] " Kees Cook 2015-11-25 17:26 ` Kees Cook 2015-11-25 17:26 ` Kees Cook 2015-11-25 17:31 ` [kernel-hardening] " H. Peter Anvin 2015-11-25 17:31 ` H. Peter Anvin 2015-11-25 18:54 ` [kernel-hardening] " Kees Cook 2015-11-25 18:54 ` Kees Cook 2015-11-25 19:06 ` H. Peter Anvin 2015-11-25 19:06 ` H. Peter Anvin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1448401114-24650-3-git-send-email-keescook@chromium.org \ --to=keescook@chromium.org \ --cc=arnd@arndb.de \ --cc=hpa@zytor.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-arch@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=mingo@redhat.com \ --cc=mpe@ellerman.id.au \ --cc=tglx@linutronix.de \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.