Re: [Ksummit-discuss] [TECH TOPIC] Kernel Hardening

[Jiri Kosina <jikos@kernel.org>]

On Mon, 31 Aug 2015, Eric W. Biederman wrote:

> At the same time I think we to serious consider tossing attempts that
> fails to close a class of exploits.
> 
> The kernel address space randomization on x86_64 I find disturbing.  We
> have a 2GB address space for kernel code.  We have pages that are 2MB in
> that address space.  So we only have 10 bits that can change.  Only 9
> bits that can change if the kernel needs more than one 2MB page.  Which
> means that at most we need to brute force 1024 things to exploit any
> weakness.

I understand what you are saying. OTOH, assuming that kernel doesn't leak 
addressess when restrict_kptr is set, it's rather likely that bruteforcing 
attempt to exploit the kernel is going to crash it instead of privilege 
escalation happenin (because the address wouldn't match, and either the 
kernel will #GP directly, or do some totally random garbage and crash 
shortly afterwards).

It's still *pretty* bad, but arguably better than being silently 
compromised without anyone noticing.

> I don't see that attempt at kernel self protection actually 
> accomplishing anything in the way of protection, and I do see it costing 
> us debuggability which impacts kernel maintenance.  

When kaslr appeared, my first reaction also was "this will be disaster for 
debugability and post-mortem crashdump analysis", but it turns out to work 
out pretty well.

What particular concerncs do you have in this respect?

-- 
Jiri Kosina
SUSE Labs