Suggested Patch is not working for 22851 Bugzilla issue

Suggested Patch is not working for 22851 Bugzilla issue

[Bala S]

Hi Mhocko,

https://sourceware.org/bugzilla/show_bug.cgi?id=22851
For the above issue, I have found the patch.

Patch link:
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1561935.html

Only change i noticed is 'MAP_FIXED_NOREPLACE' is used instead of
'MAP_FIXED_SAFE'.

I ran test case on the following targets with this patch:

1. For X86-64, Still i could see the reported issue( 'libevil.so' just
runs ‘cat /etc/passwd')

2. For MIPS-64, i am not seeing the malicious file content as
reported. But ‘ldd’ could not found ‘libevil.so’.

root@qemumips64:~/LIN1019-1806# ldd ./main
        linux-vdso.so.1 (0x000000fff1f20000)
        libevil.so => not found
        libc.so.6 => /lib/libc.so.6 (0x0000005e46f70000)
        /lib/ld.so.1 (0x000000fff7888000)

I am not clear why this patch is not working for X86-64? But it is
working for MIPS-64 with some issue.
Please let me know, if anything is pending on this patch for the reported issue.

Thanks,
Bala

Re: Suggested Patch is not working for 22851 Bugzilla issue

[Michal Hocko]

Hi
let me add Kees Cook and Linus to the cc list. I didn't have much
time to study the bug report and cannot really comment on the security
aspect of it. But let me point out that a big part of
MAP_FIXED_NOREPLACE usage has been removed from the loader code just
recently because it has caused some regressions
http://lkml.kernel.org/r/20191005233227.GB25745@shell.armlinux.org.uk
b212921b13bd ("elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings").
So you definitely want to look at the current Linus tree for your future
experiments.

On Tue 19-11-19 10:37:44, Bala S wrote:
> Hi Mhocko,
> 
> https://sourceware.org/bugzilla/show_bug.cgi?id=22851
> For the above issue, I have found the patch.
> 
> Patch link:
> https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1561935.html
> 
> Only change i noticed is 'MAP_FIXED_NOREPLACE' is used instead of
> 'MAP_FIXED_SAFE'.
> 
> I ran test case on the following targets with this patch:
> 
> 1. For X86-64, Still i could see the reported issue( 'libevil.so' just
> runs ‘cat /etc/passwd')
> 
> 2. For MIPS-64, i am not seeing the malicious file content as
> reported. But ‘ldd’ could not found ‘libevil.so’.
> 
> root@qemumips64:~/LIN1019-1806# ldd ./main
>         linux-vdso.so.1 (0x000000fff1f20000)
>         libevil.so => not found
>         libc.so.6 => /lib/libc.so.6 (0x0000005e46f70000)
>         /lib/ld.so.1 (0x000000fff7888000)
> 
> I am not clear why this patch is not working for X86-64? But it is
> working for MIPS-64 with some issue.
> Please let me know, if anything is pending on this patch for the reported issue.
> 
> Thanks,
> Bala

-- 
Michal Hocko
SUSE Labs

Re: Suggested Patch is not working for 22851 Bugzilla issue

[Kees Cook]

On Tue, Nov 19, 2019 at 10:57:08AM +0100, Michal Hocko wrote:
> let me add Kees Cook and Linus to the cc list. I didn't have much
> time to study the bug report and cannot really comment on the security
> aspect of it. But let me point out that a big part of
> MAP_FIXED_NOREPLACE usage has been removed from the loader code just
> recently because it has caused some regressions
> http://lkml.kernel.org/r/20191005233227.GB25745@shell.armlinux.org.uk
> b212921b13bd ("elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings").
> So you definitely want to look at the current Linus tree for your future
> experiments.

Hi!

Yes, as Michal mentions, there were legitimate binaries that expected to
overlap mappings, so we had to revert the MAP_FIXED_NOREPLACE logic for
now. At the time I added a TODO item for fixing this up correctly here:
https://github.com/KSPP/linux/issues/17

Speaking to the ldd issue (not the kernel binfmt_elf.c loader, which
is very separate), there isn't a security issue here: ldd can in many
cases _execute_ the binaries it is examining. This is a well known flaw
(as Florian points out in the bug report).

Is there some other piece of this puzzle you're trying to solve? I'm
always open to hearing new ideas in this space.

Thanks!

-Kees

> 
> On Tue 19-11-19 10:37:44, Bala S wrote:
> > Hi Mhocko,
> > 
> > https://sourceware.org/bugzilla/show_bug.cgi?id=22851
> > For the above issue, I have found the patch.
> > 
> > Patch link:
> > https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1561935.html
> > 
> > Only change i noticed is 'MAP_FIXED_NOREPLACE' is used instead of
> > 'MAP_FIXED_SAFE'.
> > 
> > I ran test case on the following targets with this patch:
> > 
> > 1. For X86-64, Still i could see the reported issue( 'libevil.so' just
> > runs ‘cat /etc/passwd')
> > 
> > 2. For MIPS-64, i am not seeing the malicious file content as
> > reported. But ‘ldd’ could not found ‘libevil.so’.
> > 
> > root@qemumips64:~/LIN1019-1806# ldd ./main
> >         linux-vdso.so.1 (0x000000fff1f20000)
> >         libevil.so => not found
> >         libc.so.6 => /lib/libc.so.6 (0x0000005e46f70000)
> >         /lib/ld.so.1 (0x000000fff7888000)
> > 
> > I am not clear why this patch is not working for X86-64? But it is
> > working for MIPS-64 with some issue.
> > Please let me know, if anything is pending on this patch for the reported issue.
> > 
> > Thanks,
> > Bala
> 
> -- 
> Michal Hocko
> SUSE Labs

-- 
Kees Cook

Re: Suggested Patch is not working for 22851 Bugzilla issue

[Linus Torvalds]

On Wed, Nov 20, 2019 at 10:39 AM Kees Cook <keescook@chromium.org> wrote:
> Yes, as Michal mentions, there were legitimate binaries that expected to
> overlap mappings

I'm not sure they were really overlapping as much as "the ELF sections
were in a bad order and we don't do the whole "optimize loading"
thing.

It's one of those things that *might* be fixed by first creating a
"simplified/combined map of the ELF sections", and them using mmap()
on that simplified one. But that code is nasty and hairy.

             Linus