From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A812C10DCE for ; Tue, 24 Mar 2020 21:29:06 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EF4132076F for ; Tue, 24 Mar 2020 21:29:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="YSCmWxRY" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EF4132076F Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 855AD6B0005; Tue, 24 Mar 2020 17:29:05 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7E0716B0006; Tue, 24 Mar 2020 17:29:05 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6A7BB6B0007; Tue, 24 Mar 2020 17:29:05 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0238.hostedemail.com [216.40.44.238]) by kanga.kvack.org (Postfix) with ESMTP id 4DACE6B0005 for ; Tue, 24 Mar 2020 17:29:05 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 022B818233FA4 for ; Tue, 24 Mar 2020 21:29:05 +0000 (UTC) X-FDA: 76631546250.16.fear47_3225943fbc72f X-HE-Tag: fear47_3225943fbc72f X-Filterd-Recvd-Size: 4694 Received: from mail-lj1-f195.google.com (mail-lj1-f195.google.com [209.85.208.195]) by imf06.hostedemail.com (Postfix) with ESMTP for ; Tue, 24 Mar 2020 21:29:04 +0000 (UTC) Received: by mail-lj1-f195.google.com with SMTP id g12so301000ljj.3 for ; Tue, 24 Mar 2020 14:29:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mt9R6MAwAgMsRiTLzlySm2VmV71YyEXXijbHmE8WTzk=; b=YSCmWxRY40BGiMze1Yvin1YLkJXXl+PFUME/YQdtuWumwzPRmAdvKghADmWKlRrN0K f9xnko63sgT0KH37iYw/9/MXZe1oLeb2jpfOZFVn6TSxlkYn1LgOxa54s9Ewh6bUAMOy BTu90myx9FunEp53IT4emC25nbXXzPJhnl84W6vhgEIa5wtgGP30cMvv/5ZskWvr8+4O Nr3uuT2MSmd1BDUPB1tsmSRiIQExkkO/w1eNM2f0qE61UeZwTTOh9IfxQOOmNTpezIgO mLkwFd5DYS6Gf4stv1h7MySVYHXya5QyIbq/2+4YJQUlIUc7dad9mqPuRzul6/Z7nzr+ FAAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mt9R6MAwAgMsRiTLzlySm2VmV71YyEXXijbHmE8WTzk=; b=iAzJFkEp/WMQ2sa+m1TMa/74K+IV5vQCANZ+xIOBeCLbxwuAwPMg+uFOjngrQl33// 8ib8rDyMgJ9+gG7ffpdoOh9AmGW3b9/lFdi+54XheDcC029r5sQ4rp3IloJ2VmVgHWX9 zgTPFgtUbA4prLm024obZdU2IR33t3xXFEZ55Tu1KfVq9vveTlgdmyPiyBPHKimhyP+8 S+RiP4/bMIbFN552uYZ20K7REGl9NeJ801tm2wx73OtzM491RPSg79CTPHh4ACHnsbSt E+mNJFDGQI6M6GNLNh0K9d5IkzrpDoES/leSCj6S9gfaiHLuHV1PrbwJc0BPUeLIxDbw +/ow== X-Gm-Message-State: ANhLgQ2Ir5C3tFYr+0JHzzimB9CSkzbf5JO0kIYHUqRqqYW3lAKZj3uH aEheuEY9MV1Hw4ICaFOU83nYmCK2SPAwm0vej0k9YA== X-Google-Smtp-Source: ADFU+vv8d+tvt43tW6wjpsme/liCuo5+2rssm9plm9lpdQXp8OhLUCZZ8xFwlvpxLM+HptNYxGF5KgkzMO7Hg0NPccQ= X-Received: by 2002:a2e:89c1:: with SMTP id c1mr17348550ljk.215.1585085342690; Tue, 24 Mar 2020 14:29:02 -0700 (PDT) MIME-Version: 1.0 References: <20200324203231.64324-1-keescook@chromium.org> In-Reply-To: <20200324203231.64324-1-keescook@chromium.org> From: Jann Horn Date: Tue, 24 Mar 2020 22:28:35 +0100 Message-ID: Subject: Re: [PATCH v2 0/5] Optionally randomize kernel stack offset each syscall To: Kees Cook Cc: Thomas Gleixner , Elena Reshetova , "the arch/x86 maintainers" , Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Ard Biesheuvel , "Perla, Enrico" , Kernel Hardening , linux-arm-kernel@lists.infradead.org, Linux-MM , kernel list Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Mar 24, 2020 at 9:32 PM Kees Cook wrote: > This is a continuation and refactoring of Elena's earlier effort to add > kernel stack base offset randomization. In the time since the previous > discussions, two attacks[1][2] were made public that depended on stack > determinism, so we're no longer in the position of "this is a good idea > but we have no examples of attacks". :) [...] > [1] https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html This one only starts using the stack's location after having parsed it out of dmesg (which in any environment that wants to provide a reasonable level of security really ought to be restricted to root), right? If you give people read access to dmesg, they can leak all sorts of pointers; not just the stack pointer, but also whatever else happens to be in the registers at that point - which is likely to give the attacker more ways to place controlled data at a known location. See e.g. , which leaks the pointer to a BPF map out of dmesg. Also, are you sure that it isn't possible to make the syscall that leaked its stack pointer never return to userspace (via ptrace or SIGSTOP or something like that), and therefore never realign its stack, while keeping some controlled data present on the syscall's stack? > [2] https://repositorio-aberto.up.pt/bitstream/10216/125357/2/374717.pdf That's a moderately large document; which specific part are you referencing?