From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752858AbdGGNum (ORCPT ); Fri, 7 Jul 2017 09:50:42 -0400 Received: from resqmta-ch2-09v.sys.comcast.net ([69.252.207.41]:48078 "EHLO resqmta-ch2-09v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752588AbdGGNuj (ORCPT ); Fri, 7 Jul 2017 09:50:39 -0400 Date: Fri, 7 Jul 2017 08:50:33 -0500 (CDT) From: Christoph Lameter X-X-Sender: cl@east.gentwo.org To: Kees Cook cc: Rik van Riel , Andrew Morton , Pekka Enberg , David Rientjes , Joonsoo Kim , "Paul E. McKenney" , Ingo Molnar , Josh Triplett , Andy Lutomirski , Nicolas Pitre , Tejun Heo , Daniel Mack , Sebastian Andrzej Siewior , Sergey Senozhatsky , Helge Deller , Linux-MM , Tycho Andersen , LKML , "kernel-hardening@lists.openwall.com" Subject: Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation In-Reply-To: Message-ID: References: <20170706002718.GA102852@beast> <1499363602.26846.3.camel@redhat.com> Content-Type: text/plain; charset=US-ASCII X-CMAE-Envelope: MS4wfEY91oK/gj9U8GI62EUwDhCPLYhBRHfs51G3px6jcp4PML38gYIo1M3EIfKpEODgtqQbo6RjTz34uniYGzk6xZsifRkZlBsnrnP7WnSoD7Vi1iOGolf8 P1o9BVhHY/1LshrxAtESfJ4Cevx6HzobOd2wbkzO6POb7XoWhmblHExHCuDuRsjQkHf30j3CdARFc0UP/L//eGBpcIm2b8O2W3OGQszuDPRPxg7lYqOpPK3k 6W3yd1y9hSkp+B+phY2NL/NFB0WjFZHrEIWlg9aNJRk0t0hajZVaWYvF/vDPc3azC0OkeCLEaWJBKfIcG6IQElU7okJv3VMZVwVDLn7XYmxNGBDqKM+0rzMf xWZktHdE6mDZQz035gGjcaRmsI7UT7FhJsPj8gBG3EC4DUquLfyte9F/R0zjZ4SWVs6ISj4opIz8LH8ux8TdWv28MHeXgd52j9g5W5lSmY7VmaB43FK4k1vg uuDvaorQurWulhQPnFXfHJMxFR4+joQwp9RT+SkEjbKE6rJncHYdY48QI8tIOF6gmTmS3OQoCsJnUCfEz2Kf2NNkmVWpG0x6nMQ+rMj+WNzdHlFgUtgtA9/4 B77li8s13VvonDzrIrH1nQVWz576mtYBpsGwaUzKgZ8HAfI+NlsKGpYOqTqAv8puUMtOxCnZGu0k3/VG2NKjefSH3RPFv45eGoqxFEaPsNmerO4W5LIrv/Si Mcma/Wbi+/n3qTNVyMgyRHRDWLb/OGJtf3YUfjzuGQHZAAQWH+k9aBv/d3KGE2S/2Y1BPaP1ykM= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 6 Jul 2017, Kees Cook wrote: > Right. This is about blocking the escalation of attack capability. For > slab object overflow flaws, there are mainly two exploitation methods: > adjacent allocated object overwrite and adjacent freed object > overwrite (i.e. a freelist pointer overwrite). The first attack > depends heavily on which slab cache (and therefore which structures) > has been exposed by the bug. It's a very narrow and specific attack > method. The freelist attack is entirely general purpose since it > provides a reliable way to gain arbitrary write capabilities. > Protecting against that attack greatly narrows the options for an > attacker which makes attacks more expensive to create and possibly > less reliable (and reliability is crucial to successful attacks). The simplest thing here is to vary the location of the freelist pointer. That way you cannot hit the freepointer in a deterministic way The freepointer is put at offset 0 right now. But you could put it anywhere in the object. Index: linux/mm/slub.c =================================================================== --- linux.orig/mm/slub.c +++ linux/mm/slub.c @@ -3467,7 +3467,8 @@ static int calculate_sizes(struct kmem_c */ s->offset = size; size += sizeof(void *); - } + } else + s->offset = s->size / sizeof(void *) * #ifdef CONFIG_SLUB_DEBUG if (flags & SLAB_STORE_USER) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-it0-f72.google.com (mail-it0-f72.google.com [209.85.214.72]) by kanga.kvack.org (Postfix) with ESMTP id 36FD46B03D1 for ; Fri, 7 Jul 2017 09:50:38 -0400 (EDT) Received: by mail-it0-f72.google.com with SMTP id 188so49996816itx.9 for ; Fri, 07 Jul 2017 06:50:38 -0700 (PDT) Received: from resqmta-ch2-04v.sys.comcast.net (resqmta-ch2-04v.sys.comcast.net. [2001:558:fe21:29:69:252:207:36]) by mx.google.com with ESMTPS id d197si3442223itb.138.2017.07.07.06.50.37 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 07 Jul 2017 06:50:37 -0700 (PDT) Date: Fri, 7 Jul 2017 08:50:33 -0500 (CDT) From: Christoph Lameter Subject: Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation In-Reply-To: Message-ID: References: <20170706002718.GA102852@beast> <1499363602.26846.3.camel@redhat.com> Content-Type: text/plain; charset=US-ASCII Sender: owner-linux-mm@kvack.org List-ID: To: Kees Cook Cc: Rik van Riel , Andrew Morton , Pekka Enberg , David Rientjes , Joonsoo Kim , "Paul E. McKenney" , Ingo Molnar , Josh Triplett , Andy Lutomirski , Nicolas Pitre , Tejun Heo , Daniel Mack , Sebastian Andrzej Siewior , Sergey Senozhatsky , Helge Deller , Linux-MM , Tycho Andersen , LKML , "kernel-hardening@lists.openwall.com" On Thu, 6 Jul 2017, Kees Cook wrote: > Right. This is about blocking the escalation of attack capability. For > slab object overflow flaws, there are mainly two exploitation methods: > adjacent allocated object overwrite and adjacent freed object > overwrite (i.e. a freelist pointer overwrite). The first attack > depends heavily on which slab cache (and therefore which structures) > has been exposed by the bug. It's a very narrow and specific attack > method. The freelist attack is entirely general purpose since it > provides a reliable way to gain arbitrary write capabilities. > Protecting against that attack greatly narrows the options for an > attacker which makes attacks more expensive to create and possibly > less reliable (and reliability is crucial to successful attacks). The simplest thing here is to vary the location of the freelist pointer. That way you cannot hit the freepointer in a deterministic way The freepointer is put at offset 0 right now. But you could put it anywhere in the object. Index: linux/mm/slub.c =================================================================== --- linux.orig/mm/slub.c +++ linux/mm/slub.c @@ -3467,7 +3467,8 @@ static int calculate_sizes(struct kmem_c */ s->offset = size; size += sizeof(void *); - } + } else + s->offset = s->size / sizeof(void *) * #ifdef CONFIG_SLUB_DEBUG if (flags & SLAB_STORE_USER) -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Fri, 7 Jul 2017 08:50:33 -0500 (CDT) From: Christoph Lameter In-Reply-To: Message-ID: References: <20170706002718.GA102852@beast> <1499363602.26846.3.camel@redhat.com> Content-Type: text/plain; charset=US-ASCII Subject: [kernel-hardening] Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation To: Kees Cook Cc: Rik van Riel , Andrew Morton , Pekka Enberg , David Rientjes , Joonsoo Kim , "Paul E. McKenney" , Ingo Molnar , Josh Triplett , Andy Lutomirski , Nicolas Pitre , Tejun Heo , Daniel Mack , Sebastian Andrzej Siewior , Sergey Senozhatsky , Helge Deller , Linux-MM , Tycho Andersen , LKML , "kernel-hardening@lists.openwall.com" List-ID: On Thu, 6 Jul 2017, Kees Cook wrote: > Right. This is about blocking the escalation of attack capability. For > slab object overflow flaws, there are mainly two exploitation methods: > adjacent allocated object overwrite and adjacent freed object > overwrite (i.e. a freelist pointer overwrite). The first attack > depends heavily on which slab cache (and therefore which structures) > has been exposed by the bug. It's a very narrow and specific attack > method. The freelist attack is entirely general purpose since it > provides a reliable way to gain arbitrary write capabilities. > Protecting against that attack greatly narrows the options for an > attacker which makes attacks more expensive to create and possibly > less reliable (and reliability is crucial to successful attacks). The simplest thing here is to vary the location of the freelist pointer. That way you cannot hit the freepointer in a deterministic way The freepointer is put at offset 0 right now. But you could put it anywhere in the object. Index: linux/mm/slub.c =================================================================== --- linux.orig/mm/slub.c +++ linux/mm/slub.c @@ -3467,7 +3467,8 @@ static int calculate_sizes(struct kmem_c */ s->offset = size; size += sizeof(void *); - } + } else + s->offset = s->size / sizeof(void *) * #ifdef CONFIG_SLUB_DEBUG if (flags & SLAB_STORE_USER)