From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Sender: Ingo Molnar Date: Thu, 5 Jan 2017 09:11:14 +0100 From: Ingo Molnar Message-ID: <20170105081114.GD2098@gmail.com> References: <20170104221630.831-1-thgarnie@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170104221630.831-1-thgarnie@google.com> Subject: [kernel-hardening] Re: [RFC] x86/mm/KASLR: Remap GDTs at fixed location To: Thomas Garnier Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Kees Cook , Borislav Petkov , Andy Lutomirski , Dave Hansen , Chen Yucong , Arjan van de Ven , Paul Gortmaker , Andrew Morton , Masahiro Yamada , Sebastian Andrzej Siewior , Anna-Maria Gleixner , Boris Ostrovsky , Rasmus Villemoes , Michael Ellerman , Juergen Gross , Richard Weinberger , x86@kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Linus Torvalds , Peter Zijlstra List-ID: * Thomas Garnier wrote: > Each processor holds a GDT in its per-cpu structure. The sgdt > instruction gives the base address of the current GDT. This address can > be used to bypass KASLR memory randomization. With another bug, an > attacker could target other per-cpu structures or deduce the base of the > main memory section (PAGE_OFFSET). > > In this change, a space is reserved at the end of the memory range > available for KASLR memory randomization. The space is big enough to hold > the maximum number of CPUs (as defined by setup_max_cpus). Each GDT is > mapped at specific offset based on the target CPU. Note that if there is > not enough space available, the GDTs are not remapped. > > The document was changed to mention GDT remapping for KASLR. This patch > also include dump page tables support. > > This patch was tested on multiple hardware configurations and for > hibernation support. > void kernel_randomize_memory(void); > +void kernel_randomize_smp(void); > +void* kaslr_get_gdt_remap(int cpu); Yeah, no fundamental objections from me to the principle, but I get some bad vibes from the naming here: seeing that kernel_randomize_smp() actually makes things less random. Also, don't we want to do this unconditionally and not allow remapping failures? The GDT is fairly small, plus making the SGDT instruction expose fewer kernel internals would be (marginally) useful on non-randomized kernels as well. It also makes the code more common, more predictable, more debuggable and less complex overall - which is pretty valuable in terms of long term security as well. Thanks, Ingo From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S970010AbdAEIVA (ORCPT ); Thu, 5 Jan 2017 03:21:00 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:33393 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1033116AbdAEITe (ORCPT ); Thu, 5 Jan 2017 03:19:34 -0500 Date: Thu, 5 Jan 2017 09:11:14 +0100 From: Ingo Molnar To: Thomas Garnier Cc: Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Kees Cook , Borislav Petkov , Andy Lutomirski , Dave Hansen , Chen Yucong , Arjan van de Ven , Paul Gortmaker , Andrew Morton , Masahiro Yamada , Sebastian Andrzej Siewior , Anna-Maria Gleixner , Boris Ostrovsky , Rasmus Villemoes , Michael Ellerman , Juergen Gross , Richard Weinberger , x86@kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Linus Torvalds , Peter Zijlstra Subject: Re: [RFC] x86/mm/KASLR: Remap GDTs at fixed location Message-ID: <20170105081114.GD2098@gmail.com> References: <20170104221630.831-1-thgarnie@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170104221630.831-1-thgarnie@google.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Thomas Garnier wrote: > Each processor holds a GDT in its per-cpu structure. The sgdt > instruction gives the base address of the current GDT. This address can > be used to bypass KASLR memory randomization. With another bug, an > attacker could target other per-cpu structures or deduce the base of the > main memory section (PAGE_OFFSET). > > In this change, a space is reserved at the end of the memory range > available for KASLR memory randomization. The space is big enough to hold > the maximum number of CPUs (as defined by setup_max_cpus). Each GDT is > mapped at specific offset based on the target CPU. Note that if there is > not enough space available, the GDTs are not remapped. > > The document was changed to mention GDT remapping for KASLR. This patch > also include dump page tables support. > > This patch was tested on multiple hardware configurations and for > hibernation support. > void kernel_randomize_memory(void); > +void kernel_randomize_smp(void); > +void* kaslr_get_gdt_remap(int cpu); Yeah, no fundamental objections from me to the principle, but I get some bad vibes from the naming here: seeing that kernel_randomize_smp() actually makes things less random. Also, don't we want to do this unconditionally and not allow remapping failures? The GDT is fairly small, plus making the SGDT instruction expose fewer kernel internals would be (marginally) useful on non-randomized kernels as well. It also makes the code more common, more predictable, more debuggable and less complex overall - which is pretty valuable in terms of long term security as well. Thanks, Ingo