Re: [kernel-hardening] [RFC] x86, mm: start mmap allocation for libs from low addresses

[Solar Designer <solar@openwall.com>]

Vasiliy,

On Wed, Sep 07, 2011 at 01:34:11PM +0400, Vasiliy Kulikov wrote:
> On Wed, Sep 07, 2011 at 13:30 +0400, Solar Designer wrote:
> > What if mmap_min_addr set really low, or is even 0?  I think we want to
> > skip low addresses even if processes are permitted to use those.
> > (Permitted does not mean encouraged.)  So how about ASCII_ARMOR_MIN_ADDR
> > 0x19000 (100 KB) when !CONFIG_VM86?
> 
> Are you talking about safety with NULL pointer dereferencing?

Yes.  Besides deliberate attacks, we want inadvertent NULL pointer
dereferences to be detected by the kernel as such.  This wouldn't happen
if the kernel itself happens to map something at NULL in almost every
process just because someone set mmap_min_addr to 0 e.g. to be able to
occasionally run a certain userspace app that needs that.

Then, there may be attack scenarios where the attacker is not able to
invoke mmap() in the process via which the attack on the kernel is
initiated - e.g., some daemon process over which the attacker has only
partial control over a certain protocol.  Thus, low mmap_min_addr
wouldn't be directly exploitable by the attacker, and we shouldn't be
making matters worse with this patch.

Alexander