* [PATCH 0/4] migrate swapper_pg_dir
@ 2018-05-29 4:37 YaoJun
2018-05-29 10:03 ` Mark Rutland
0 siblings, 1 reply; 2+ messages in thread
From: YaoJun @ 2018-05-29 4:37 UTC (permalink / raw)
To: kernel-hardening; +Cc: linux-kernel, linux-security-module, jmorris
Because the offset between swapper_pg_dir and _text is fixed, when
attackers break KASLR, they can calculate the address of swapper_pg_dir,
and then they can apply KSMA(Kernel Space Mirror Attack). The principle
of KSMA is to insert an entry to PGD, and this entry has type of block
with AP = 01, so attackers can read/write kernel memory directly. Details
can reference:
https://www.blackhat.com/docs/asia-18/asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf
These patches migrate swapper_pg_dir to new place, and there is no
relationship between swapper_pg_dir and _text. Because this is done
during kernel booting, the physical address of new swapper_pg_dir may
be fixed. Do we need to further randomize it?
YaoJun (4):
Introduce a variable to record physical address of swapper_pg_dir.
Introduce a variable to record new virtual address of swapper_pg_dir.
Make tramp_pg_dir and swapper_pg_dir adjacent
Migrate swapper_pg_dir and tramp_pg_dir.
arch/arm64/include/asm/mmu_context.h | 6 +--
arch/arm64/include/asm/pgtable.h | 2 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/entry.S | 4 +-
arch/arm64/kernel/head.S | 10 ++--
arch/arm64/kernel/hibernate.c | 2 +-
arch/arm64/kernel/sleep.S | 2 +
arch/arm64/kernel/vmlinux.lds.S | 10 ++--
arch/arm64/mm/kasan_init.c | 6 +--
arch/arm64/mm/mmu.c | 72 +++++++++++++++++++---------
10 files changed, 74 insertions(+), 42 deletions(-)
--
2.17.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 0/4] migrate swapper_pg_dir
2018-05-29 4:37 [PATCH 0/4] migrate swapper_pg_dir YaoJun
@ 2018-05-29 10:03 ` Mark Rutland
0 siblings, 0 replies; 2+ messages in thread
From: Mark Rutland @ 2018-05-29 10:03 UTC (permalink / raw)
To: YaoJun; +Cc: kernel-hardening, linux-kernel, linux-security-module, jmorris
Hi,
On Tue, May 29, 2018 at 12:37:28PM +0800, YaoJun wrote:
> Because the offset between swapper_pg_dir and _text is fixed, when
> attackers break KASLR, they can calculate the address of swapper_pg_dir,
> and then they can apply KSMA(Kernel Space Mirror Attack). The principle
> of KSMA is to insert an entry to PGD, and this entry has type of block
> with AP = 01, so attackers can read/write kernel memory directly. Details
> can reference:
>
> https://www.blackhat.com/docs/asia-18/asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf
>
> These patches migrate swapper_pg_dir to new place, and there is no
> relationship between swapper_pg_dir and _text. Because this is done
> during kernel booting, the physical address of new swapper_pg_dir may
> be fixed. Do we need to further randomize it?
This looks interesting, but this didn't go to all the relevant people.
Could you please resend this series, with at least the following Cc'd:
* linux-arm-kernel@lists.infradead.org
* will.deacon@arm.com
* catalin.marinas@arm.com
Thanks,
Mark.
>
> YaoJun (4):
> Introduce a variable to record physical address of swapper_pg_dir.
> Introduce a variable to record new virtual address of swapper_pg_dir.
> Make tramp_pg_dir and swapper_pg_dir adjacent
> Migrate swapper_pg_dir and tramp_pg_dir.
>
> arch/arm64/include/asm/mmu_context.h | 6 +--
> arch/arm64/include/asm/pgtable.h | 2 +
> arch/arm64/kernel/cpufeature.c | 2 +-
> arch/arm64/kernel/entry.S | 4 +-
> arch/arm64/kernel/head.S | 10 ++--
> arch/arm64/kernel/hibernate.c | 2 +-
> arch/arm64/kernel/sleep.S | 2 +
> arch/arm64/kernel/vmlinux.lds.S | 10 ++--
> arch/arm64/mm/kasan_init.c | 6 +--
> arch/arm64/mm/mmu.c | 72 +++++++++++++++++++---------
> 10 files changed, 74 insertions(+), 42 deletions(-)
>
> --
> 2.17.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-05-29 10:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-29 4:37 [PATCH 0/4] migrate swapper_pg_dir YaoJun
2018-05-29 10:03 ` Mark Rutland
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).