From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA0ADC56201 for ; Wed, 18 Nov 2020 22:42:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8035E2468D for ; Wed, 18 Nov 2020 22:42:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="wM9aPQLk" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727193AbgKRWm5 (ORCPT ); Wed, 18 Nov 2020 17:42:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59296 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726081AbgKRWm5 (ORCPT ); Wed, 18 Nov 2020 17:42:57 -0500 Received: from mail-lf1-x141.google.com (mail-lf1-x141.google.com [IPv6:2a00:1450:4864:20::141]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D606AC0613D4 for ; Wed, 18 Nov 2020 14:42:56 -0800 (PST) Received: by mail-lf1-x141.google.com with SMTP id v144so5328515lfa.13 for ; Wed, 18 Nov 2020 14:42:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ixC0u6OyfxUYrt6QPqUZ5rujN8BJlqxwPvY/3+nhmXw=; b=wM9aPQLkCBhozlv2tfs90X5CI/Gs7zj3W6yTsPL8ES9kkqjKh9iwLJkDQbSmZNpPLv RkDOiDVBzFOBN7f2DWutl/757ig3/smDTusOtJ0ogOVayqIKQf03FO221+RCzKz0RL1M lIePHojAzGK+lkneSQi3IaBQCGycKs9Is3+G/9FX2LGDtYxarsXwe+NvcRF1w0eD8vc5 57UiQ/6QoCU1He2HVP18Mkb6b7FyJI8E4/ztzOoiGFc69FJKJsZkoCUHCpldX1hGS5Bd +qciHnJn+5niJMe/hEyj2WRvIbyvqkFLZwU5jjNk7p7pJ3hoTwMcIaW/78Dt5d4afqBH z88w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ixC0u6OyfxUYrt6QPqUZ5rujN8BJlqxwPvY/3+nhmXw=; b=nUzueaPpxbEROuyPh9mNUs0avYlmlYXmkmotc0qDsLipakpdYiHcbhv1UDmPXi8pJq z33I7hmH5vswlBAL38c0hz2IZHPWnn5uH9gpwMHt4d/lRXzNQoJakwFjXxu8WgFdKAqq JcmA7BXU40iYippV/KsMBZY1lQMohXeZC0FMy1H5d24OZp5CrBt5yAWUfdn/MNaTovq5 0/ZfEypKwZukH9xO25kywgQzedjJs+iSFIcTwyptrOBKy5hpyfzK3I7d22TYZdYNqMt7 xl3s3ophK75uwS7j/ZrVsyXcJgZD5Gv4iSl3sTkkp/Ih1cAq72ohktdbULJe37n3M46g TYsQ== X-Gm-Message-State: AOAM532VGflRLS+snzc1U1puhbocqclcebSZr0PGxVQ0XsVLeTmS2YxV Ij7R9EFLIDq4IDztza80lLmqGI2iTWFWtMFL8UcQUA== X-Google-Smtp-Source: ABdhPJxl5FB4w+I/3B3Kt/0LDlsbAGvVIt8KjuVNjLyXl4970VrDg0GQ1NlTl543R7gFJlHkLyHKMWM5T6NkljfYu5Q= X-Received: by 2002:a05:6512:348e:: with SMTP id v14mr4178858lfr.97.1605739375008; Wed, 18 Nov 2020 14:42:55 -0800 (PST) MIME-Version: 1.0 References: <20201026160518.9212-1-toiwoton@gmail.com> <20201117165455.GN29991@casper.infradead.org> In-Reply-To: <20201117165455.GN29991@casper.infradead.org> From: Jann Horn Date: Wed, 18 Nov 2020 23:42:28 +0100 Message-ID: Subject: Re: [PATCH v4] mm: Optional full ASLR for mmap() and mremap() To: Matthew Wilcox Cc: Topi Miettinen , linux-hardening@vger.kernel.org, Andrew Morton , Linux-MM , kernel list , Kees Cook , Mike Rapoport , Mateusz Jurczyk , Kernel Hardening Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 17, 2020 at 5:55 PM Matthew Wilcox wrote: > On Mon, Oct 26, 2020 at 06:05:18PM +0200, Topi Miettinen wrote: > > Writing a new value of 3 to /proc/sys/kernel/randomize_va_space > > enables full randomization of memory mappings created with mmap(NULL, > > ...). With 2, the base of the VMA used for such mappings is random, > > but the mappings are created in predictable places within the VMA and > > in sequential order. With 3, new VMAs are created to fully randomize > > the mappings. Also mremap(..., MREMAP_MAYMOVE) will move the mappings > > even if not necessary. > > Is this worth it? > > https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/aslrcache-practical-cache-attacks-mmu/ Yeah, against local attacks (including from JavaScript), ASLR isn't very robust; but it should still help against true remote attacks (modulo crazyness like NetSpectre). E.g. Mateusz Jurczyk's remote Samsung phone exploit via MMS messages (https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html) would've probably been quite a bit harder to pull off if he hadn't been able to rely on having all those memory mappings sandwiched together. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E33CC63697 for ; Wed, 18 Nov 2020 22:42:59 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id AA669246E4 for ; Wed, 18 Nov 2020 22:42:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="wM9aPQLk" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AA669246E4 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 05C0A6B0036; Wed, 18 Nov 2020 17:42:58 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 033A26B005C; Wed, 18 Nov 2020 17:42:57 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DF4DE6B005D; Wed, 18 Nov 2020 17:42:57 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0138.hostedemail.com [216.40.44.138]) by kanga.kvack.org (Postfix) with ESMTP id AF1E76B0036 for ; Wed, 18 Nov 2020 17:42:57 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 4F4ED180AD83B for ; Wed, 18 Nov 2020 22:42:57 +0000 (UTC) X-FDA: 77499015594.28.rake03_60093502733d Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin28.hostedemail.com (Postfix) with ESMTP id 2E6B46C29 for ; Wed, 18 Nov 2020 22:42:57 +0000 (UTC) X-HE-Tag: rake03_60093502733d X-Filterd-Recvd-Size: 4135 Received: from mail-lf1-f68.google.com (mail-lf1-f68.google.com [209.85.167.68]) by imf36.hostedemail.com (Postfix) with ESMTP for ; Wed, 18 Nov 2020 22:42:56 +0000 (UTC) Received: by mail-lf1-f68.google.com with SMTP id f11so5403896lfs.3 for ; Wed, 18 Nov 2020 14:42:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ixC0u6OyfxUYrt6QPqUZ5rujN8BJlqxwPvY/3+nhmXw=; b=wM9aPQLkCBhozlv2tfs90X5CI/Gs7zj3W6yTsPL8ES9kkqjKh9iwLJkDQbSmZNpPLv RkDOiDVBzFOBN7f2DWutl/757ig3/smDTusOtJ0ogOVayqIKQf03FO221+RCzKz0RL1M lIePHojAzGK+lkneSQi3IaBQCGycKs9Is3+G/9FX2LGDtYxarsXwe+NvcRF1w0eD8vc5 57UiQ/6QoCU1He2HVP18Mkb6b7FyJI8E4/ztzOoiGFc69FJKJsZkoCUHCpldX1hGS5Bd +qciHnJn+5niJMe/hEyj2WRvIbyvqkFLZwU5jjNk7p7pJ3hoTwMcIaW/78Dt5d4afqBH z88w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ixC0u6OyfxUYrt6QPqUZ5rujN8BJlqxwPvY/3+nhmXw=; b=c6TZB5jhwJaEu6Wen+tIH7p7dT6KhfAj97Jr3gv7UW/tfZ22a9vMXCcqzaHYy2dY4B 40NHHjoaL2woj0Emb/m22rEYhD35CydVYfLWBdlc/reFzzLAJvFEsJfrxKv4dkJCV0s2 zJUJC3vYjNC0frxb2xnrQTRJ00bN/+EACTj19Y7egLNpTebv1ah449mhq1cA+N3SCvY1 AEHf5B+oX/Fvzee5HKiN0Y00R2TGu4cm9ufTGTB2ege3XKfHBPygOAQ430I6kXlswJ6c +6yPC7VuJQJ1vg/WKImVKkj3FQx38fb03TWwvyTmx0hVh/pC+Z9jzM3sqTezmsphQ5Fp CjQg== X-Gm-Message-State: AOAM532JhX9vX/VuoFqdb+YnZMaC7TT3IXUGXxNtAKeZIQ17TDAeBDNi QLHaCckUYPZKoC9ngJJkaDEOF2lYMcqbR0+8oRpeSA== X-Google-Smtp-Source: ABdhPJxl5FB4w+I/3B3Kt/0LDlsbAGvVIt8KjuVNjLyXl4970VrDg0GQ1NlTl543R7gFJlHkLyHKMWM5T6NkljfYu5Q= X-Received: by 2002:a05:6512:348e:: with SMTP id v14mr4178858lfr.97.1605739375008; Wed, 18 Nov 2020 14:42:55 -0800 (PST) MIME-Version: 1.0 References: <20201026160518.9212-1-toiwoton@gmail.com> <20201117165455.GN29991@casper.infradead.org> In-Reply-To: <20201117165455.GN29991@casper.infradead.org> From: Jann Horn Date: Wed, 18 Nov 2020 23:42:28 +0100 Message-ID: Subject: Re: [PATCH v4] mm: Optional full ASLR for mmap() and mremap() To: Matthew Wilcox Cc: Topi Miettinen , linux-hardening@vger.kernel.org, Andrew Morton , Linux-MM , kernel list , Kees Cook , Mike Rapoport , Mateusz Jurczyk , Kernel Hardening Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000043, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 17, 2020 at 5:55 PM Matthew Wilcox wrote: > On Mon, Oct 26, 2020 at 06:05:18PM +0200, Topi Miettinen wrote: > > Writing a new value of 3 to /proc/sys/kernel/randomize_va_space > > enables full randomization of memory mappings created with mmap(NULL, > > ...). With 2, the base of the VMA used for such mappings is random, > > but the mappings are created in predictable places within the VMA and > > in sequential order. With 3, new VMAs are created to fully randomize > > the mappings. Also mremap(..., MREMAP_MAYMOVE) will move the mappings > > even if not necessary. > > Is this worth it? > > https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/aslrcache-practical-cache-attacks-mmu/ Yeah, against local attacks (including from JavaScript), ASLR isn't very robust; but it should still help against true remote attacks (modulo crazyness like NetSpectre). E.g. Mateusz Jurczyk's remote Samsung phone exploit via MMS messages (https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html) would've probably been quite a bit harder to pull off if he hadn't been able to rely on having all those memory mappings sandwiched together.