From: Topi Miettinen <toiwoton@gmail.com>
To: Jann Horn <jannh@google.com>, Matthew Wilcox <willy@infradead.org>
Cc: linux-hardening@vger.kernel.org,
Andrew Morton <akpm@linux-foundation.org>,
Linux-MM <linux-mm@kvack.org>,
kernel list <linux-kernel@vger.kernel.org>,
Kees Cook <keescook@chromium.org>,
Mike Rapoport <rppt@kernel.org>,
Mateusz Jurczyk <mjurczyk@google.com>,
Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: Re: [PATCH v4] mm: Optional full ASLR for mmap() and mremap()
Date: Thu, 19 Nov 2020 11:16:04 +0200 [thread overview]
Message-ID: <7a10cb0c-4426-c0b9-7933-8de5f1a86d67@gmail.com> (raw)
In-Reply-To: <CAG48ez0LyOMnA4Khv9eV1_JpEJhjZy4jJYF=ze3Ha2vSNAfapw@mail.gmail.com>
On 19.11.2020 0.42, Jann Horn wrote:
> On Tue, Nov 17, 2020 at 5:55 PM Matthew Wilcox <willy@infradead.org> wrote:
>> On Mon, Oct 26, 2020 at 06:05:18PM +0200, Topi Miettinen wrote:
>>> Writing a new value of 3 to /proc/sys/kernel/randomize_va_space
>>> enables full randomization of memory mappings created with mmap(NULL,
>>> ...). With 2, the base of the VMA used for such mappings is random,
>>> but the mappings are created in predictable places within the VMA and
>>> in sequential order. With 3, new VMAs are created to fully randomize
>>> the mappings. Also mremap(..., MREMAP_MAYMOVE) will move the mappings
>>> even if not necessary.
>>
>> Is this worth it?
>>
>> https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/aslrcache-practical-cache-attacks-mmu/
>
> Yeah, against local attacks (including from JavaScript), ASLR isn't
> very robust; but it should still help against true remote attacks
> (modulo crazyness like NetSpectre).
>
> E.g. Mateusz Jurczyk's remote Samsung phone exploit via MMS messages
> (https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html)
> would've probably been quite a bit harder to pull off if he hadn't
> been able to rely on having all those memory mappings sandwiched
> together.
Compiling the system with -mcmodel=large should also help, since then
even within one library, the address space layout of various segments
(text, data, rodata) could be randomized individually and then finding
the XOM wouldn't aid in finding the other segments. But this model isn't
so well supported yet (GCC:
https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html, not sure about
LLVM).
-Topi
next prev parent reply other threads:[~2020-11-19 9:16 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-26 16:05 [PATCH v4] mm: Optional full ASLR for mmap() and mremap() Topi Miettinen
2020-11-17 16:54 ` Matthew Wilcox
2020-11-17 20:21 ` Topi Miettinen
2020-11-18 17:40 ` Mike Rapoport
[not found] ` <6810b874c8df456b890d1092273b354a@pexch011a.vu.local>
2020-11-18 18:49 ` Cristiano Giuffrida
2020-11-19 9:59 ` Topi Miettinen
[not found] ` <0da9cb0a4d1a494d9ec15404f8decf01@pexch011a.vu.local>
2020-11-19 22:20 ` Cristiano Giuffrida
2020-11-20 8:38 ` Topi Miettinen
2020-11-20 15:27 ` Matthew Wilcox
[not found] ` <d7e759c8ac444aa4b0ba6932563aca00@pexch011a.vu.local>
2020-11-20 14:10 ` Cristiano Giuffrida
2020-11-20 19:37 ` Topi Miettinen
2020-11-18 22:42 ` Jann Horn
2020-11-19 9:16 ` Topi Miettinen [this message]
2020-11-24 18:27 ` Vlastimil Babka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7a10cb0c-4426-c0b9-7933-8de5f1a86d67@gmail.com \
--to=toiwoton@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=jannh@google.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mjurczyk@google.com \
--cc=rppt@kernel.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).