From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755082AbdFXTQs (ORCPT ); Sat, 24 Jun 2017 15:16:48 -0400 Received: from mail-it0-f52.google.com ([209.85.214.52]:37008 "EHLO mail-it0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754970AbdFXTQp (ORCPT ); Sat, 24 Jun 2017 15:16:45 -0400 MIME-Version: 1.0 In-Reply-To: <1498251600-132458-2-git-send-email-keescook@chromium.org> References: <1498251600-132458-1-git-send-email-keescook@chromium.org> <1498251600-132458-2-git-send-email-keescook@chromium.org> From: Kees Cook Date: Sat, 24 Jun 2017 12:16:42 -0700 X-Google-Sender-Auth: hgKzg9-GEppp7Z_nHYy3SXPPGfk Message-ID: Subject: Re: [PATCH v2 1/5] binfmt_elf: Use ELF_ET_DYN_BASE only for PIE To: Andrew Morton Cc: Kees Cook , "# 3.4.x" , "x86@kernel.org" , Rik van Riel , Ard Biesheuvel , Daniel Micay , Qualys Security Advisory , Russell King , Catalin Marinas , Will Deacon , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Alexander Viro , Pratyush Anand , James Hogan , Dmitry Safonov , Grzegorz Andrejczuk , Masahiro Yamada , LKML , "linux-arm-kernel@lists.infradead.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-s390@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "kernel-hardening@lists.openwall.com" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jun 23, 2017 at 1:59 PM, Kees Cook wrote: > For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs > are loaded below the mmap region. This means they can be made to collide > (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological > stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs > above the mmap region in all cases, and will now additionally avoid > programs falling back to the mmap region by enforcing MAP_FIXED for > program loads (i.e. if it would have collided with the stack, now it > will fail to load instead of falling back to the mmap region). It was pointed out by rmk that I described this inaccurately. I mix up my own visualization of the address space (above/below in /proc/$pid/maps) with actual value comparisons (above/below numerically). This paragraph should read: For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs are loaded above the mmap region. This means they can be made to collide (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs below the mmap region in all cases, and will now additionally avoid programs falling back to the mmap region by enforcing MAP_FIXED for program loads (i.e. if it would have collided with the stack, now it will fail to load instead of falling back to the mmap region). Andrew, are you able to manually adjust this commit log in -mm, or should I resend the patch with this paragraph corrected? Thanks! -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: <1498251600-132458-2-git-send-email-keescook@chromium.org> References: <1498251600-132458-1-git-send-email-keescook@chromium.org> <1498251600-132458-2-git-send-email-keescook@chromium.org> From: Kees Cook Date: Sat, 24 Jun 2017 12:16:42 -0700 Message-ID: Content-Type: text/plain; charset="UTF-8" Subject: [kernel-hardening] Re: [PATCH v2 1/5] binfmt_elf: Use ELF_ET_DYN_BASE only for PIE List-Archive: List-Post: To: Andrew Morton Cc: Kees Cook , "# 3.4.x" , "x86@kernel.org" , Rik van Riel , Ard Biesheuvel , Daniel Micay , Qualys Security Advisory , Russell King , Catalin Marinas , Will Deacon , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Alexander Viro , Pratyush Anand , James Hogan , Dmitry Safonov , Grzegorz Andrejczuk , Masahiro Yamada , LKML , "linux-arm-kernel@lists.infradead.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-s390@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "kernel-hardening@lists.openwall.com" List-ID: On Fri, Jun 23, 2017 at 1:59 PM, Kees Cook wrote: > For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs > are loaded below the mmap region. This means they can be made to collide > (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological > stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs > above the mmap region in all cases, and will now additionally avoid > programs falling back to the mmap region by enforcing MAP_FIXED for > program loads (i.e. if it would have collided with the stack, now it > will fail to load instead of falling back to the mmap region). It was pointed out by rmk that I described this inaccurately. I mix up my own visualization of the address space (above/below in /proc/$pid/maps) with actual value comparisons (above/below numerically). This paragraph should read: For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs are loaded above the mmap region. This means they can be made to collide (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs below the mmap region in all cases, and will now additionally avoid programs falling back to the mmap region by enforcing MAP_FIXED for program loads (i.e. if it would have collided with the stack, now it will fail to load instead of falling back to the mmap region). Andrew, are you able to manually adjust this commit log in -mm, or should I resend the patch with this paragraph corrected? Thanks! -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: MIME-Version: 1.0 In-Reply-To: <1498251600-132458-2-git-send-email-keescook@chromium.org> References: <1498251600-132458-1-git-send-email-keescook@chromium.org> <1498251600-132458-2-git-send-email-keescook@chromium.org> From: Kees Cook Date: Sat, 24 Jun 2017 12:16:42 -0700 Message-ID: Subject: Re: [PATCH v2 1/5] binfmt_elf: Use ELF_ET_DYN_BASE only for PIE To: Andrew Morton Cc: Kees Cook , "# 3.4.x" , "x86@kernel.org" , Rik van Riel , Ard Biesheuvel , Daniel Micay , Qualys Security Advisory , Russell King , Catalin Marinas , Will Deacon , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Alexander Viro , Pratyush Anand , James Hogan , Dmitry Safonov , Grzegorz Andrejczuk , Masahiro Yamada , LKML , "linux-arm-kernel@lists.infradead.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-s390@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "kernel-hardening@lists.openwall.com" Content-Type: text/plain; charset="UTF-8" Sender: stable-owner@vger.kernel.org List-ID: On Fri, Jun 23, 2017 at 1:59 PM, Kees Cook wrote: > For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs > are loaded below the mmap region. This means they can be made to collide > (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological > stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs > above the mmap region in all cases, and will now additionally avoid > programs falling back to the mmap region by enforcing MAP_FIXED for > program loads (i.e. if it would have collided with the stack, now it > will fail to load instead of falling back to the mmap region). It was pointed out by rmk that I described this inaccurately. I mix up my own visualization of the address space (above/below in /proc/$pid/maps) with actual value comparisons (above/below numerically). This paragraph should read: For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs are loaded above the mmap region. This means they can be made to collide (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs below the mmap region in all cases, and will now additionally avoid programs falling back to the mmap region by enforcing MAP_FIXED for program loads (i.e. if it would have collided with the stack, now it will fail to load instead of falling back to the mmap region). Andrew, are you able to manually adjust this commit log in -mm, or should I resend the patch with this paragraph corrected? Thanks! -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: keescook@chromium.org (Kees Cook) Date: Sat, 24 Jun 2017 12:16:42 -0700 Subject: [PATCH v2 1/5] binfmt_elf: Use ELF_ET_DYN_BASE only for PIE In-Reply-To: <1498251600-132458-2-git-send-email-keescook@chromium.org> References: <1498251600-132458-1-git-send-email-keescook@chromium.org> <1498251600-132458-2-git-send-email-keescook@chromium.org> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Fri, Jun 23, 2017 at 1:59 PM, Kees Cook wrote: > For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs > are loaded below the mmap region. This means they can be made to collide > (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological > stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs > above the mmap region in all cases, and will now additionally avoid > programs falling back to the mmap region by enforcing MAP_FIXED for > program loads (i.e. if it would have collided with the stack, now it > will fail to load instead of falling back to the mmap region). It was pointed out by rmk that I described this inaccurately. I mix up my own visualization of the address space (above/below in /proc/$pid/maps) with actual value comparisons (above/below numerically). This paragraph should read: For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs are loaded above the mmap region. This means they can be made to collide (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs below the mmap region in all cases, and will now additionally avoid programs falling back to the mmap region by enforcing MAP_FIXED for program loads (i.e. if it would have collided with the stack, now it will fail to load instead of falling back to the mmap region). Andrew, are you able to manually adjust this commit log in -mm, or should I resend the patch with this paragraph corrected? Thanks! -Kees -- Kees Cook Pixel Security