From: Julien Tinnes <jt@cr0.org>
To: hch@infradead.org
Cc: security@kernel.org, taviso@sdf.lonestar.org,
linux-kernel@vger.kernel.org
Subject: [patch 1/1] personality handling: fix PER_CLEAR_ON_SETID for security reasons
Date: Fri, 26 Jun 2009 20:27:40 +0200 [thread overview]
Message-ID: <deb7a2310906261127v2fd1564elb823716ae03fc0d4@mail.gmail.com> (raw)
Hello,
We have found that the current PER_CLEAR_ON_SETID mask on Linux
doesn't include neither ADDR_COMPAT_LAYOUT, nor MMAP_PAGE_ZERO.
The current mask is READ_IMPLIES_EXEC|ADDR_NO_RANDOMIZE.
We believe it is important to add MMAP_PAGE_ZERO, because by using
this personality it is possible to have the first page mapped inside a
process running as setuid root. This could be used in those scenarios:
- Exploiting a NULL pointer dereference issue in a setuid root binary
- Bypassing the mmap_min_addr restrictions of the Linux kernel: by
running a setuid binary that would drop privileges before giving us
control back (for instance by loading a user-supplied library), we
could get the first page mapped in a process we control. By further
using mremap and mprotect on this mapping, we can then completely
bypass the mmap_min_addr restrictions.
Less importantly, we believe ADDR_COMPAT_LAYOUT should also be added
since on x86 32bits it will in practice disable most of the address
space layout randomization (only the stack will remain randomized).
Signed-off-by: Julien Tinnes <jt@cr0.org> and Tavis Ormandy
<taviso@sdf.lonestar.org>
---
diff -r f70f443c9ead include/linux/personality.h
--- a/include/linux/personality.h Fri Jun 26 19:59:33 2009 +0200
+++ b/include/linux/personality.h Fri Jun 26 20:00:40 2009 +0200
@@ -40,7 +40,7 @@ enum {
* Security-relevant compatibility flags that must be
* cleared upon setuid or setgid exec:
*/
-#define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC|ADDR_NO_RANDOMIZE)
+#define PER_CLEAR_ON_SETID
(READ_IMPLIES_EXEC|ADDR_NO_RANDOMIZE|ADDR_COMPAT_LAYOUT|MMAP_PAGE_ZERO)
/*
* Personality types.
next reply other threads:[~2009-06-26 18:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-06-26 18:27 Julien Tinnes [this message]
2009-06-28 20:40 ` [patch 1/1] personality handling: fix PER_CLEAR_ON_SETID for security reasons Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=deb7a2310906261127v2fd1564elb823716ae03fc0d4@mail.gmail.com \
--to=jt@cr0.org \
--cc=hch@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=security@kernel.org \
--cc=taviso@sdf.lonestar.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).