From: Kees Cook <keescook@chromium.org> To: Thomas Gleixner <tglx@linutronix.de> Cc: Kees Cook <keescook@chromium.org>, Elena Reshetova <elena.reshetova@intel.com>, x86@kernel.org, Andy Lutomirski <luto@kernel.org>, Peter Zijlstra <peterz@infradead.org>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will@kernel.org>, Mark Rutland <mark.rutland@arm.com>, Alexander Potapenko <glider@google.com>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, Jann Horn <jannh@google.com>, "Perla, Enrico" <enrico.perla@intel.com>, kernel-hardening@lists.openwall.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 0/5] Optionally randomize kernel stack offset each syscall Date: Tue, 24 Mar 2020 13:32:26 -0700 [thread overview] Message-ID: <20200324203231.64324-1-keescook@chromium.org> (raw) Hi, This is a continuation and refactoring of Elena's earlier effort to add kernel stack base offset randomization. In the time since the previous discussions, two attacks[1][2] were made public that depended on stack determinism, so we're no longer in the position of "this is a good idea but we have no examples of attacks". :) Earlier discussions also devolved into debates on entropy sources, which is mostly a red herring, given the already low entropy available due to stack size. Regardless, entropy can be changed/improved separately from this series as needed. Earlier discussions also got stuck debating how much syscall overhead was too much, but this is also a red herring since the feature itself needs to be selectable at boot with no cost for those that don't want it: this is solved here with static branches. So, here is an improved version, made as arch-agnostic as possible, with usage added for x86 and arm64. It also includes some small static branch clean ups. -Kees [1] https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html [2] https://repositorio-aberto.up.pt/bitstream/10216/125357/2/374717.pdf v2: - move to per-cpu rdtsc() saved on syscall exit - add static branches for zero-cost dynamic enabling - Kconfig just selects the default state of static branch - __builtin_alloca() produces ugly asm without -fno-stack-clash-protection - made arch agnostic rfc: https://lore.kernel.org/kernel-hardening/20190329081358.30497-1-elena.reshetova@intel.com/ Kees Cook (5): jump_label: Provide CONFIG-driven build state defaults init_on_alloc: Unpessimize default-on builds stack: Optionally randomize kernel stack offset each syscall x86/entry: Enable random_kstack_offset support arm64: entry: Enable random_kstack_offset support Makefile | 4 ++++ arch/Kconfig | 19 +++++++++++++++ arch/arm64/Kconfig | 1 + arch/arm64/kernel/syscall.c | 10 ++++++++ arch/x86/Kconfig | 1 + arch/x86/entry/common.c | 12 +++++++++- include/linux/jump_label.h | 19 +++++++++++++++ include/linux/mm.h | 18 +++++--------- include/linux/randomize_kstack.h | 40 ++++++++++++++++++++++++++++++++ init/main.c | 23 ++++++++++++++++++ mm/page_alloc.c | 12 ++-------- 11 files changed, 136 insertions(+), 23 deletions(-) create mode 100644 include/linux/randomize_kstack.h -- 2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org> To: Thomas Gleixner <tglx@linutronix.de> Cc: Mark Rutland <mark.rutland@arm.com>, Kees Cook <keescook@chromium.org>, Jann Horn <jannh@google.com>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, Peter Zijlstra <peterz@infradead.org>, Catalin Marinas <catalin.marinas@arm.com>, x86@kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Alexander Potapenko <glider@google.com>, linux-arm-kernel@lists.infradead.org, Andy Lutomirski <luto@kernel.org>, kernel-hardening@lists.openwall.com, "Perla, Enrico" <enrico.perla@intel.com>, Will Deacon <will@kernel.org>, Elena Reshetova <elena.reshetova@intel.com> Subject: [PATCH v2 0/5] Optionally randomize kernel stack offset each syscall Date: Tue, 24 Mar 2020 13:32:26 -0700 [thread overview] Message-ID: <20200324203231.64324-1-keescook@chromium.org> (raw) Hi, This is a continuation and refactoring of Elena's earlier effort to add kernel stack base offset randomization. In the time since the previous discussions, two attacks[1][2] were made public that depended on stack determinism, so we're no longer in the position of "this is a good idea but we have no examples of attacks". :) Earlier discussions also devolved into debates on entropy sources, which is mostly a red herring, given the already low entropy available due to stack size. Regardless, entropy can be changed/improved separately from this series as needed. Earlier discussions also got stuck debating how much syscall overhead was too much, but this is also a red herring since the feature itself needs to be selectable at boot with no cost for those that don't want it: this is solved here with static branches. So, here is an improved version, made as arch-agnostic as possible, with usage added for x86 and arm64. It also includes some small static branch clean ups. -Kees [1] https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html [2] https://repositorio-aberto.up.pt/bitstream/10216/125357/2/374717.pdf v2: - move to per-cpu rdtsc() saved on syscall exit - add static branches for zero-cost dynamic enabling - Kconfig just selects the default state of static branch - __builtin_alloca() produces ugly asm without -fno-stack-clash-protection - made arch agnostic rfc: https://lore.kernel.org/kernel-hardening/20190329081358.30497-1-elena.reshetova@intel.com/ Kees Cook (5): jump_label: Provide CONFIG-driven build state defaults init_on_alloc: Unpessimize default-on builds stack: Optionally randomize kernel stack offset each syscall x86/entry: Enable random_kstack_offset support arm64: entry: Enable random_kstack_offset support Makefile | 4 ++++ arch/Kconfig | 19 +++++++++++++++ arch/arm64/Kconfig | 1 + arch/arm64/kernel/syscall.c | 10 ++++++++ arch/x86/Kconfig | 1 + arch/x86/entry/common.c | 12 +++++++++- include/linux/jump_label.h | 19 +++++++++++++++ include/linux/mm.h | 18 +++++--------- include/linux/randomize_kstack.h | 40 ++++++++++++++++++++++++++++++++ init/main.c | 23 ++++++++++++++++++ mm/page_alloc.c | 12 ++-------- 11 files changed, 136 insertions(+), 23 deletions(-) create mode 100644 include/linux/randomize_kstack.h -- 2.20.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2020-03-24 20:32 UTC|newest] Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-03-24 20:32 Kees Cook [this message] 2020-03-24 20:32 ` [PATCH v2 0/5] Optionally randomize kernel stack offset each syscall Kees Cook 2020-03-24 20:32 ` [PATCH v2 1/5] jump_label: Provide CONFIG-driven build state defaults Kees Cook 2020-03-24 20:32 ` Kees Cook 2020-03-24 22:06 ` Peter Zijlstra 2020-03-24 22:06 ` Peter Zijlstra 2020-03-24 20:32 ` [PATCH v2 2/5] init_on_alloc: Unpessimize default-on builds Kees Cook 2020-03-24 20:32 ` Kees Cook 2020-03-26 15:48 ` Alexander Potapenko 2020-03-26 15:48 ` Alexander Potapenko 2020-03-26 15:48 ` Alexander Potapenko 2020-03-24 20:32 ` [PATCH v2 3/5] stack: Optionally randomize kernel stack offset each syscall Kees Cook 2020-03-24 20:32 ` Kees Cook 2020-03-30 11:25 ` Mark Rutland 2020-03-30 11:25 ` Mark Rutland 2020-03-30 18:18 ` Kees Cook 2020-03-30 18:18 ` Kees Cook 2020-03-30 18:27 ` Kees Cook 2020-03-30 18:27 ` Kees Cook 2020-03-24 20:32 ` [PATCH v2 4/5] x86/entry: Enable random_kstack_offset support Kees Cook 2020-03-24 20:32 ` Kees Cook 2020-03-28 22:26 ` Kees Cook 2020-03-28 22:26 ` Kees Cook 2020-03-24 20:32 ` [PATCH v2 5/5] arm64: entry: " Kees Cook 2020-03-24 20:32 ` Kees Cook 2020-03-25 13:21 ` Mark Rutland 2020-03-25 13:21 ` Mark Rutland 2020-03-25 20:22 ` Kees Cook 2020-03-25 20:22 ` Kees Cook 2020-03-26 11:15 ` Mark Rutland 2020-03-26 11:15 ` Mark Rutland 2020-03-26 16:31 ` Kees Cook 2020-03-26 16:31 ` Kees Cook 2020-03-30 11:26 ` Mark Rutland 2020-03-30 11:26 ` Mark Rutland 2020-04-20 20:54 ` Will Deacon 2020-04-20 20:54 ` Will Deacon 2020-04-20 22:34 ` Kees Cook 2020-04-20 22:34 ` Kees Cook 2020-04-21 7:02 ` Will Deacon 2020-04-21 7:02 ` Will Deacon 2020-03-24 21:28 ` [PATCH v2 0/5] Optionally randomize kernel stack offset each syscall Jann Horn 2020-03-24 21:28 ` Jann Horn 2020-03-24 21:28 ` Jann Horn 2020-03-24 23:07 ` Kees Cook 2020-03-24 23:07 ` Kees Cook 2020-03-25 12:15 ` Reshetova, Elena 2020-03-25 12:15 ` Reshetova, Elena 2020-03-25 12:15 ` Reshetova, Elena 2020-03-25 20:27 ` Kees Cook 2020-03-25 20:27 ` Kees Cook 2020-03-25 20:27 ` Kees Cook 2020-03-25 23:20 ` Jann Horn 2020-03-25 23:20 ` Jann Horn 2020-03-25 23:20 ` Jann Horn 2020-03-26 17:18 ` Kees Cook 2020-03-26 17:18 ` Kees Cook 2020-03-26 17:18 ` Kees Cook
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200324203231.64324-1-keescook@chromium.org \ --to=keescook@chromium.org \ --cc=ard.biesheuvel@linaro.org \ --cc=catalin.marinas@arm.com \ --cc=elena.reshetova@intel.com \ --cc=enrico.perla@intel.com \ --cc=glider@google.com \ --cc=jannh@google.com \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@kernel.org \ --cc=mark.rutland@arm.com \ --cc=peterz@infradead.org \ --cc=tglx@linutronix.de \ --cc=will@kernel.org \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.