All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 0/3] efi: Initialize canary to non-zero value
@ 2023-12-19  5:59 Glenn Washburn
  2023-12-19  5:59 ` [PATCH v3 1/3] " Glenn Washburn
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Glenn Washburn @ 2023-12-19  5:59 UTC (permalink / raw)
  To: The development of GNU GRUB, Daniel Kiper
  Cc: Heinrich Schuchardt, Dimitri John Ledkov, Glenn Washburn

Updates from v2:
 * Change NULL to NUL
 * Describe more why it is desirable to have a NUL byte in the canary

Glenn

Glenn Washburn (3):
  efi: Initialize canary to non-zero value
  efi: Generate stack protector canary at build time if urandom is
    available
  efi: Add support for reproducible builds

 config.h.in               |  2 ++
 configure.ac              | 22 ++++++++++++++++++++++
 grub-core/kern/efi/init.c |  3 ++-
 3 files changed, 26 insertions(+), 1 deletion(-)

Range-diff against v2:
1:  a993f050ce89 ! 1:  c4d3769d2c26 efi: Initialize canary to non-zero value
    @@ Commit message
         support the RNG protocol, then the canary will not be randomized and will
         be zero. This seems like a possibly easier value to write by an attacker.
         Initialize canary to static random bytes, so that it is still random when
    -    there is no RNG protocol. Set at least one byte to NULL to protect against
    -    string buffer overflow attacks.
    +    there is no RNG protocol. Set at least one byte to NUL to protect against
    +    string buffer overflow attacks. Code that writes NUL terminated strings
    +    will terminate when a NUL is encountered in the input byte stream. So the
    +    attacker will not be able to forge the canary by including it in the input
    +    stream without terminating the string operation and thus limiting the
    +    stack corruption.
    +
    +    [1] https://www.sans.org/blog/stack-canaries-gingerly-sidestepping-the-cage/
     
      ## grub-core/kern/efi/init.c ##
     @@ grub-core/kern/efi/init.c: static grub_guid_t rng_protocol_guid = GRUB_EFI_RNG_PROTOCOL_GUID;
2:  177ae1cf1015 ! 2:  01a56aed2f26 efi: Generate stack protector canary at build time if urandom is available
    @@ Commit message
         Fallback to the statically generated random bytes if /dev/urandom is not
         readable (eg. Windows).
     
    -    Reduce the canary to 3 bytes with a NULL upper byte on 32-bit architectures,
    -    which use a 32-bit canary, to filter out string buffer overflow attacks.
    +    On 32-bit architectures, which use a 32-bit canary, reduce the canary to 4
    +    bytes with one byte being NUL to filter out string buffer overflow attacks.
     
      ## config.h.in ##
     @@
    @@ configure.ac: else
     +
     +  if test -r /dev/urandom; then
     +     # Generate the 8 byte stack protector canary at build time if /dev/urandom
    -+     # is able to be read. The first byte should be NULL to filter out string
    ++     # is able to be read. The first byte should be NUL to filter out string
     +     # buffer overflow attacks.
     +     GRUB_STACK_PROTECTOR_INIT="$($PYTHON -c 'import codecs; rf=open("/dev/urandom", "rb"); print("0x00"+codecs.encode(rf.read(7), "hex").decode("ascii"))')"
     +  else
    @@ configure.ac: else
     +
     +  if test x"$target_m32" = x1 ; then
     +    # Make sure that the canary default value is 24-bits by only using the
    -+    # lower 3 bytes on 32 bit systems. This allows the upper byte to be NULL
    ++    # lower 3 bytes on 32 bit systems. This allows the upper byte to be NUL
     +    # to filter out string buffer overflow attacks.
     +    GRUB_STACK_PROTECTOR_INIT="0x00$(echo "$GRUB_STACK_PROTECTOR_INIT" | sed 's/.*\(......\)$/\1/')"
     +  fi
3:  c38fa7791697 ! 3:  5989c0102154 efi: Add support for reproducible builds
    @@ configure.ac: else
     +     GRUB_STACK_PROTECTOR_INIT="0x00f2b7e2$(printf "%x" "$SOURCE_DATE_EPOCH" | sed 's/.*\(........\)$/\1/')"
     +  elif test -r /dev/urandom; then
           # Generate the 8 byte stack protector canary at build time if /dev/urandom
    -      # is able to be read. The first byte should be NULL to filter out string
    +      # is able to be read. The first byte should be NUL to filter out string
           # buffer overflow attacks.
-- 
2.34.1


_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-12-20 13:09 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-12-19  5:59 [PATCH v3 0/3] efi: Initialize canary to non-zero value Glenn Washburn
2023-12-19  5:59 ` [PATCH v3 1/3] " Glenn Washburn
2023-12-19  6:00 ` [PATCH v3 2/3] efi: Generate stack protector canary at build time if urandom is available Glenn Washburn
2023-12-19  6:00 ` [PATCH v3 3/3] efi: Add support for reproducible builds Glenn Washburn
2023-12-20 13:09 ` [PATCH v3 0/3] efi: Initialize canary to non-zero value Daniel Kiper

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.