* [PATCH 0/4] arm64/mm: migrate swapper_pg_dir
@ 2018-06-01 8:08 Jun Yao
2018-06-01 9:42 ` Robin Murphy
0 siblings, 1 reply; 4+ messages in thread
From: Jun Yao @ 2018-06-01 8:08 UTC (permalink / raw)
To: linux-arm-kernel
Cc: catalin.marinas, will.deacon, linux-kernel, kernel-hardening, greg
Currently, The offset between swapper_pg_dir and _text is
fixed. When attackers know the address of _text(no KASLR or
breaking KASLR), they can caculate the address of
swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can
be applied.
The principle of KSMA is to insert a carefully constructed PGD
entry into the translation table. The type of this entry is
block, which maps the kernel text and its access permissions
bits are 01. The user process can then modify kernel text
directly through this mapping.
To protect against KSMA, these patches migrate swapper_pg_dir
to new place, which is dynamically allocated. Since it is
allocated during the kernel boot process and the address is
relatively fixed, further randomization may be required.
Jun Yao (4):
arm64/mm: pass swapper_pg_dir as an argument to __enable_mmu()
arm64/mm: introduce variable to save new swapper_pg_dir address
arm64/mm: make tramp_pg_dir and swapper_pg_dir adjacent
arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
arch/arm64/include/asm/mmu_context.h | 6 +--
arch/arm64/include/asm/pgtable.h | 2 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/entry.S | 4 +-
arch/arm64/kernel/head.S | 10 ++--
arch/arm64/kernel/hibernate.c | 2 +-
arch/arm64/kernel/sleep.S | 2 +
arch/arm64/kernel/vmlinux.lds.S | 9 ++--
arch/arm64/mm/kasan_init.c | 6 +--
arch/arm64/mm/mmu.c | 75 +++++++++++++++++-----------
10 files changed, 71 insertions(+), 47 deletions(-)
--
2.17.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 0/4] arm64/mm: migrate swapper_pg_dir
2018-06-01 8:08 [PATCH 0/4] arm64/mm: migrate swapper_pg_dir Jun Yao
@ 2018-06-01 9:42 ` Robin Murphy
0 siblings, 0 replies; 4+ messages in thread
From: Robin Murphy @ 2018-06-01 9:42 UTC (permalink / raw)
To: Jun Yao, linux-arm-kernel
Cc: catalin.marinas, will.deacon, linux-kernel, greg, kernel-hardening
On 01/06/18 09:08, Jun Yao wrote:
> Currently, The offset between swapper_pg_dir and _text is
> fixed. When attackers know the address of _text(no KASLR or
> breaking KASLR), they can caculate the address of
> swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can
> be applied.
>
> The principle of KSMA is to insert a carefully constructed PGD
> entry into the translation table. The type of this entry is
Out of interest, how does that part work? AFAICS, modifying a PGD entry
involves writing to kernel memory, which would mean the implication of
KSMA is "userspace can gain write permission to kernel memory by writing
to kernel memory" - that doesn't sound like an attack in itself, more
just a convenience for ease of exploiting whatever successful attack got
you in there in the first place.
That's not to say that it isn't still worth mitigating, I'm just
questioning the given rationale here.
Robin.
> block, which maps the kernel text and its access permissions
> bits are 01. The user process can then modify kernel text
> directly through this mapping.
>
> To protect against KSMA, these patches migrate swapper_pg_dir
> to new place, which is dynamically allocated. Since it is
> allocated during the kernel boot process and the address is
> relatively fixed, further randomization may be required.
>
> Jun Yao (4):
> arm64/mm: pass swapper_pg_dir as an argument to __enable_mmu()
> arm64/mm: introduce variable to save new swapper_pg_dir address
> arm64/mm: make tramp_pg_dir and swapper_pg_dir adjacent
> arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
>
> arch/arm64/include/asm/mmu_context.h | 6 +--
> arch/arm64/include/asm/pgtable.h | 2 +
> arch/arm64/kernel/cpufeature.c | 2 +-
> arch/arm64/kernel/entry.S | 4 +-
> arch/arm64/kernel/head.S | 10 ++--
> arch/arm64/kernel/hibernate.c | 2 +-
> arch/arm64/kernel/sleep.S | 2 +
> arch/arm64/kernel/vmlinux.lds.S | 9 ++--
> arch/arm64/mm/kasan_init.c | 6 +--
> arch/arm64/mm/mmu.c | 75 +++++++++++++++++-----------
> 10 files changed, 71 insertions(+), 47 deletions(-)
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 0/4] arm64/mm: migrate swapper_pg_dir
@ 2018-06-04 9:13 Jun Yao
0 siblings, 0 replies; 4+ messages in thread
From: Jun Yao @ 2018-06-04 9:13 UTC (permalink / raw)
To: robin.murphy, linux-arm-kernel
Cc: catalin.marinas, will.deacon, linux-kernel, greg, kernel-hardening
On 1 Jun 2018 at 10:42:10, Robin Murphy <robin.murphy@arm.com> wrote:
>> Currently, The offset between swapper_pg_dir and _text is
>> fixed. When attackers know the address of _text(no KASLR or
>> breaking KASLR), they can caculate the address of
>> swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can
>> be applied.
>>
>> The principle of KSMA is to insert a carefully constructed PGD
>> entry into the translation table. The type of this entry is
>
>Out of interest, how does that part work? AFAICS, modifying a PGD entry
>involves writing to kernel memory, which would mean the implication of KSMA is
>"userspace can gain write permission to kernel memory by writing to kernel
>memory" - that doesn't sound like an attack in itself, more just a convenience
>for ease of exploiting whatever successful attack got you in there in the
>first place.
>
>That's not to say that it isn't still worth mitigating, I'm just questioning
>the given rationale here.
Yes, you are right. KSMA is just a convenience for ease of exploiting. I think
that the biggest role of KSMA is to covert an arbitrary write to multiple
arbitrary writes. In the past, to accomplish this, a function
pointer(e.g. ptmx_fops) is modified to point to gadget, which can r/w kernel
memory. However, PAN makes this more difficult. And KSMA becomes a new way to
do that.
For details on KSMA, you can refer to:
https://www.blackhat.com/docs/asia-18/asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf
thanks,
Jun
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 0/4] arm64/mm: migrate swapper_pg_dir
@ 2018-05-30 9:12 YaoJun
0 siblings, 0 replies; 4+ messages in thread
From: YaoJun @ 2018-05-30 9:12 UTC (permalink / raw)
To: kernel-hardening
Cc: catalin.marinas, will.deacon, linux-arm-kernel, linux-kernel,
mark.rutland
Currently, The offset between swapper_pg_dir and _text is
fixed. When attackers know the address of _text(no KASLR or
breaking KASLR), they can caculate the address of
swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can
be applied.
The principle of KSMA is to insert a carefully constructed PGD
entry into the translation table. The type of this entry is
block, which maps the kernel text and its access permissions
bits are 01. The user process can then modify kernel text
directly through this mapping.
To protect against KSMA, these patches migrate swapper_pg_dir
to new place, which is dynamically allocated. Since it is
allocated during the kernel boot process and the address is
relatively fixed, further randomization may be required.
YaoJun (4):
arm64/mm: Introduce __pa_swapper_pg_dir to save physical
address of swapper_pg_dir. And pass it as an
argument to __enable_mmu().
arm64/mm: Introduce new_swapper_pg_dir to save virtual
address of new swapper_pg_dir.
arm64/mm: Make tramp_pg_dir and swapper_pg_dir adjacent.
arm64/mm: Migrate swapper_pg_dir and tramp_pg_dir.
arch/arm64/include/asm/mmu_context.h | 6 +--
arch/arm64/include/asm/pgtable.h | 2 +
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/entry.S | 4 +-
arch/arm64/kernel/head.S | 10 ++--
arch/arm64/kernel/hibernate.c | 2 +-
arch/arm64/kernel/sleep.S | 2 +
arch/arm64/kernel/vmlinux.lds.S | 10 ++--
arch/arm64/mm/kasan_init.c | 6 +--
arch/arm64/mm/mmu.c | 72 ++++++++++++++++++++--------
10 files changed, 75 insertions(+), 41 deletions(-)
--
2.17.0
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-06-04 9:13 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-01 8:08 [PATCH 0/4] arm64/mm: migrate swapper_pg_dir Jun Yao
2018-06-01 9:42 ` Robin Murphy
-- strict thread matches above, loose matches on Subject: below --
2018-06-04 9:13 Jun Yao
2018-05-30 9:12 YaoJun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).