From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1424338AbcBQXA5 (ORCPT ); Wed, 17 Feb 2016 18:00:57 -0500 Received: from mail-io0-f170.google.com ([209.85.223.170]:36495 "EHLO mail-io0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965500AbcBQXAx (ORCPT ); Wed, 17 Feb 2016 18:00:53 -0500 MIME-Version: 1.0 In-Reply-To: <20160217052010.GA49233@davidb.org> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <20160216213659.GA47194@davidb.org> <20160217052010.GA49233@davidb.org> Date: Wed, 17 Feb 2016 15:00:52 -0800 X-Google-Sender-Auth: C2M6XqRNFLC4jaJDXy--AUcnJUY Message-ID: Subject: Re: [PATCH] ARM: vdso: Mark vDSO code as read-only From: Kees Cook To: David Brown Cc: Russell King , "linux-arm-kernel@lists.infradead.org" , "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Feb 16, 2016 at 9:20 PM, David Brown wrote: > On Tue, Feb 16, 2016 at 01:52:33PM -0800, Kees Cook wrote: >> >> On Tue, Feb 16, 2016 at 1:36 PM, David Brown >> wrote: >>> >>> Although the arm vDSO is cleanly separated by code/data with the code >>> being read-only in userspace mappings, the code page is still writable >>> from the kernel. There have been exploits (such as >>> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go >>> from a bad kernel write to full root. >>> >>> Prevent this specific exploit on arm by putting the vDSO code page in >>> post-init read-only memory as well. >> >> >> Is the vdso dynamically built at init time like on x86, or can this >> just use .rodata directly? > > > On ARM, it is patched during init. Arm64's is just plain read-only. Okay, great. I've added this to my postinit-readonly series (which I just refreshed and sent out again...) -Kees -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH] ARM: vdso: Mark vDSO code as read-only Date: Wed, 17 Feb 2016 15:00:52 -0800 Message-ID: References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <20160216213659.GA47194@davidb.org> <20160217052010.GA49233@davidb.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: Received: from mail-io0-f169.google.com ([209.85.223.169]:33484 "EHLO mail-io0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965386AbcBQXAx (ORCPT ); Wed, 17 Feb 2016 18:00:53 -0500 Received: by mail-io0-f169.google.com with SMTP id z135so54745574iof.0 for ; Wed, 17 Feb 2016 15:00:53 -0800 (PST) In-Reply-To: <20160217052010.GA49233@davidb.org> Sender: linux-arch-owner@vger.kernel.org List-ID: To: David Brown Cc: Russell King , "linux-arm-kernel@lists.infradead.org" , "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch On Tue, Feb 16, 2016 at 9:20 PM, David Brown wrote: > On Tue, Feb 16, 2016 at 01:52:33PM -0800, Kees Cook wrote: >> >> On Tue, Feb 16, 2016 at 1:36 PM, David Brown >> wrote: >>> >>> Although the arm vDSO is cleanly separated by code/data with the code >>> being read-only in userspace mappings, the code page is still writable >>> from the kernel. There have been exploits (such as >>> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go >>> from a bad kernel write to full root. >>> >>> Prevent this specific exploit on arm by putting the vDSO code page in >>> post-init read-only memory as well. >> >> >> Is the vdso dynamically built at init time like on x86, or can this >> just use .rodata directly? > > > On ARM, it is patched during init. Arm64's is just plain read-only. Okay, great. I've added this to my postinit-readonly series (which I just refreshed and sent out again...) -Kees -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: keescook@chromium.org (Kees Cook) Date: Wed, 17 Feb 2016 15:00:52 -0800 Subject: [PATCH] ARM: vdso: Mark vDSO code as read-only In-Reply-To: <20160217052010.GA49233@davidb.org> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <20160216213659.GA47194@davidb.org> <20160217052010.GA49233@davidb.org> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Tue, Feb 16, 2016 at 9:20 PM, David Brown wrote: > On Tue, Feb 16, 2016 at 01:52:33PM -0800, Kees Cook wrote: >> >> On Tue, Feb 16, 2016 at 1:36 PM, David Brown >> wrote: >>> >>> Although the arm vDSO is cleanly separated by code/data with the code >>> being read-only in userspace mappings, the code page is still writable >>> from the kernel. There have been exploits (such as >>> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go >>> from a bad kernel write to full root. >>> >>> Prevent this specific exploit on arm by putting the vDSO code page in >>> post-init read-only memory as well. >> >> >> Is the vdso dynamically built at init time like on x86, or can this >> just use .rodata directly? > > > On ARM, it is patched during init. Arm64's is just plain read-only. Okay, great. I've added this to my postinit-readonly series (which I just refreshed and sent out again...) -Kees -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: <20160217052010.GA49233@davidb.org> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <20160216213659.GA47194@davidb.org> <20160217052010.GA49233@davidb.org> Date: Wed, 17 Feb 2016 15:00:52 -0800 Message-ID: From: Kees Cook Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH] ARM: vdso: Mark vDSO code as read-only To: David Brown Cc: Russell King , "linux-arm-kernel@lists.infradead.org" , "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch List-ID: On Tue, Feb 16, 2016 at 9:20 PM, David Brown wrote: > On Tue, Feb 16, 2016 at 01:52:33PM -0800, Kees Cook wrote: >> >> On Tue, Feb 16, 2016 at 1:36 PM, David Brown >> wrote: >>> >>> Although the arm vDSO is cleanly separated by code/data with the code >>> being read-only in userspace mappings, the code page is still writable >>> from the kernel. There have been exploits (such as >>> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go >>> from a bad kernel write to full root. >>> >>> Prevent this specific exploit on arm by putting the vDSO code page in >>> post-init read-only memory as well. >> >> >> Is the vdso dynamically built at init time like on x86, or can this >> just use .rodata directly? > > > On ARM, it is patched during init. Arm64's is just plain read-only. Okay, great. I've added this to my postinit-readonly series (which I just refreshed and sent out again...) -Kees -- Kees Cook Chrome OS & Brillo Security