* [PATCH] arm64: vdso: Mark vDSO code as read-only
@ 2016-02-10 21:52 David Brown
2016-02-11 13:47 ` Will Deacon
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: David Brown @ 2016-02-10 21:52 UTC (permalink / raw)
To: linux-arm-kernel
Although the arm64 vDSO is cleanly separated by code/data with the
code being read-only in userspace mappings, the code page is still
writable from the kernel. There have been exploits (such as
http://itszn.com/blog/?p=21) that take advantage of this on x86 to go
from a bad kernel write to full root.
Prevent this specific exploit on arm64 by putting the vDSO code page
in read-only memory as well.
Before the change:
[ 3.138366] vdso: 2 pages (1 code @ ffffffc000a71000, 1 data @ ffffffc000a70000)
---[ Kernel Mapping ]---
0xffffffc000000000-0xffffffc000082000 520K RW NX SHD AF UXN MEM/NORMAL
0xffffffc000082000-0xffffffc000200000 1528K ro x SHD AF UXN MEM/NORMAL
0xffffffc000200000-0xffffffc000800000 6M ro x SHD AF BLK UXN MEM/NORMAL
0xffffffc000800000-0xffffffc0009b6000 1752K ro x SHD AF UXN MEM/NORMAL
0xffffffc0009b6000-0xffffffc000c00000 2344K RW NX SHD AF UXN MEM/NORMAL
0xffffffc000c00000-0xffffffc008000000 116M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc00c000000-0xffffffc07f000000 1840M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc800000000-0xffffffc840000000 1G RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc840000000-0xffffffc87ae00000 942M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc87ae00000-0xffffffc87ae70000 448K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87af80000-0xffffffc87af8a000 40K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87af8b000-0xffffffc87b000000 468K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87b000000-0xffffffc87fe00000 78M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc87fe00000-0xffffffc87ff50000 1344K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87ff90000-0xffffffc87ffa0000 64K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87fff0000-0xffffffc880000000 64K RW NX SHD AF UXN MEM/NORMAL
After:
[ 3.138368] vdso: 2 pages (1 code @ ffffffc0006de000, 1 data @ ffffffc000a74000)
---[ Kernel Mapping ]---
0xffffffc000000000-0xffffffc000082000 520K RW NX SHD AF UXN MEM/NORMAL
0xffffffc000082000-0xffffffc000200000 1528K ro x SHD AF UXN MEM/NORMAL
0xffffffc000200000-0xffffffc000800000 6M ro x SHD AF BLK UXN MEM/NORMAL
0xffffffc000800000-0xffffffc0009b8000 1760K ro x SHD AF UXN MEM/NORMAL
0xffffffc0009b8000-0xffffffc000c00000 2336K RW NX SHD AF UXN MEM/NORMAL
0xffffffc000c00000-0xffffffc008000000 116M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc00c000000-0xffffffc07f000000 1840M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc800000000-0xffffffc840000000 1G RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc840000000-0xffffffc87ae00000 942M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc87ae00000-0xffffffc87ae70000 448K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87af80000-0xffffffc87af8a000 40K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87af8b000-0xffffffc87b000000 468K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87b000000-0xffffffc87fe00000 78M RW NX SHD AF BLK UXN MEM/NORMAL
0xffffffc87fe00000-0xffffffc87ff50000 1344K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87ff90000-0xffffffc87ffa0000 64K RW NX SHD AF UXN MEM/NORMAL
0xffffffc87fff0000-0xffffffc880000000 64K RW NX SHD AF UXN MEM/NORMAL
Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the
PaX Team, Brad Spengler, and Kees Cook.
Signed-off-by: David Brown <david.brown@linaro.org>
---
arch/arm64/kernel/vdso/vdso.S | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S
index 60c1db5..db7c0f2 100644
--- a/arch/arm64/kernel/vdso/vdso.S
+++ b/arch/arm64/kernel/vdso/vdso.S
@@ -24,6 +24,7 @@
__PAGE_ALIGNED_DATA
.globl vdso_start, vdso_end
+ .section .rodata
.balign PAGE_SIZE
vdso_start:
.incbin "arch/arm64/kernel/vdso/vdso.so"
--
2.7.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] arm64: vdso: Mark vDSO code as read-only
2016-02-10 21:52 [PATCH] arm64: vdso: Mark vDSO code as read-only David Brown
@ 2016-02-11 13:47 ` Will Deacon
2016-02-11 14:19 ` [kernel-hardening] " Ard Biesheuvel
2016-02-16 18:22 ` Catalin Marinas
2 siblings, 0 replies; 6+ messages in thread
From: Will Deacon @ 2016-02-11 13:47 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, Feb 10, 2016 at 01:52:22PM -0800, David Brown wrote:
> Although the arm64 vDSO is cleanly separated by code/data with the
> code being read-only in userspace mappings, the code page is still
> writable from the kernel. There have been exploits (such as
> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go
> from a bad kernel write to full root.
>
> Prevent this specific exploit on arm64 by putting the vDSO code page
> in read-only memory as well.
>
> Before the change:
> [ 3.138366] vdso: 2 pages (1 code @ ffffffc000a71000, 1 data @ ffffffc000a70000)
> ---[ Kernel Mapping ]---
> 0xffffffc000000000-0xffffffc000082000 520K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000082000-0xffffffc000200000 1528K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc000200000-0xffffffc000800000 6M ro x SHD AF BLK UXN MEM/NORMAL
> 0xffffffc000800000-0xffffffc0009b6000 1752K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc0009b6000-0xffffffc000c00000 2344K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000c00000-0xffffffc008000000 116M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc00c000000-0xffffffc07f000000 1840M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc800000000-0xffffffc840000000 1G RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc840000000-0xffffffc87ae00000 942M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87ae00000-0xffffffc87ae70000 448K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af80000-0xffffffc87af8a000 40K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af8b000-0xffffffc87b000000 468K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87b000000-0xffffffc87fe00000 78M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87fe00000-0xffffffc87ff50000 1344K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87ff90000-0xffffffc87ffa0000 64K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87fff0000-0xffffffc880000000 64K RW NX SHD AF UXN MEM/NORMAL
>
> After:
> [ 3.138368] vdso: 2 pages (1 code @ ffffffc0006de000, 1 data @ ffffffc000a74000)
> ---[ Kernel Mapping ]---
> 0xffffffc000000000-0xffffffc000082000 520K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000082000-0xffffffc000200000 1528K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc000200000-0xffffffc000800000 6M ro x SHD AF BLK UXN MEM/NORMAL
> 0xffffffc000800000-0xffffffc0009b8000 1760K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc0009b8000-0xffffffc000c00000 2336K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000c00000-0xffffffc008000000 116M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc00c000000-0xffffffc07f000000 1840M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc800000000-0xffffffc840000000 1G RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc840000000-0xffffffc87ae00000 942M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87ae00000-0xffffffc87ae70000 448K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af80000-0xffffffc87af8a000 40K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af8b000-0xffffffc87b000000 468K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87b000000-0xffffffc87fe00000 78M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87fe00000-0xffffffc87ff50000 1344K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87ff90000-0xffffffc87ffa0000 64K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87fff0000-0xffffffc880000000 64K RW NX SHD AF UXN MEM/NORMAL
>
> Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the
> PaX Team, Brad Spengler, and Kees Cook.
>
> Signed-off-by: David Brown <david.brown@linaro.org>
> ---
> arch/arm64/kernel/vdso/vdso.S | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S
> index 60c1db5..db7c0f2 100644
> --- a/arch/arm64/kernel/vdso/vdso.S
> +++ b/arch/arm64/kernel/vdso/vdso.S
> @@ -24,6 +24,7 @@
> __PAGE_ALIGNED_DATA
>
> .globl vdso_start, vdso_end
> + .section .rodata
> .balign PAGE_SIZE
> vdso_start:
> .incbin "arch/arm64/kernel/vdso/vdso.so"
Nice, I wish I'd thought of that!
Acked-by: Will Deacon <will.deacon@arm.com>
As an aside, I wonder whether we should be printing the code/data
addresses out in dmesg at all.
Will
^ permalink raw reply [flat|nested] 6+ messages in thread
* [kernel-hardening] [PATCH] arm64: vdso: Mark vDSO code as read-only
2016-02-10 21:52 [PATCH] arm64: vdso: Mark vDSO code as read-only David Brown
2016-02-11 13:47 ` Will Deacon
@ 2016-02-11 14:19 ` Ard Biesheuvel
2016-02-13 0:31 ` David Brown
2016-02-16 18:22 ` Catalin Marinas
2 siblings, 1 reply; 6+ messages in thread
From: Ard Biesheuvel @ 2016-02-11 14:19 UTC (permalink / raw)
To: linux-arm-kernel
Hi David,
Nice find!
On 10 February 2016 at 22:52, David Brown <david.brown@linaro.org> wrote:
> Although the arm64 vDSO is cleanly separated by code/data with the
> code being read-only in userspace mappings, the code page is still
> writable from the kernel. There have been exploits (such as
> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go
> from a bad kernel write to full root.
>
> Prevent this specific exploit on arm64 by putting the vDSO code page
> in read-only memory as well.
>
> Before the change:
> [ 3.138366] vdso: 2 pages (1 code @ ffffffc000a71000, 1 data @ ffffffc000a70000)
> ---[ Kernel Mapping ]---
> 0xffffffc000000000-0xffffffc000082000 520K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000082000-0xffffffc000200000 1528K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc000200000-0xffffffc000800000 6M ro x SHD AF BLK UXN MEM/NORMAL
> 0xffffffc000800000-0xffffffc0009b6000 1752K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc0009b6000-0xffffffc000c00000 2344K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000c00000-0xffffffc008000000 116M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc00c000000-0xffffffc07f000000 1840M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc800000000-0xffffffc840000000 1G RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc840000000-0xffffffc87ae00000 942M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87ae00000-0xffffffc87ae70000 448K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af80000-0xffffffc87af8a000 40K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af8b000-0xffffffc87b000000 468K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87b000000-0xffffffc87fe00000 78M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87fe00000-0xffffffc87ff50000 1344K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87ff90000-0xffffffc87ffa0000 64K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87fff0000-0xffffffc880000000 64K RW NX SHD AF UXN MEM/NORMAL
>
> After:
> [ 3.138368] vdso: 2 pages (1 code @ ffffffc0006de000, 1 data @ ffffffc000a74000)
> ---[ Kernel Mapping ]---
> 0xffffffc000000000-0xffffffc000082000 520K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000082000-0xffffffc000200000 1528K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc000200000-0xffffffc000800000 6M ro x SHD AF BLK UXN MEM/NORMAL
> 0xffffffc000800000-0xffffffc0009b8000 1760K ro x SHD AF UXN MEM/NORMAL
> 0xffffffc0009b8000-0xffffffc000c00000 2336K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc000c00000-0xffffffc008000000 116M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc00c000000-0xffffffc07f000000 1840M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc800000000-0xffffffc840000000 1G RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc840000000-0xffffffc87ae00000 942M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87ae00000-0xffffffc87ae70000 448K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af80000-0xffffffc87af8a000 40K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87af8b000-0xffffffc87b000000 468K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87b000000-0xffffffc87fe00000 78M RW NX SHD AF BLK UXN MEM/NORMAL
> 0xffffffc87fe00000-0xffffffc87ff50000 1344K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87ff90000-0xffffffc87ffa0000 64K RW NX SHD AF UXN MEM/NORMAL
> 0xffffffc87fff0000-0xffffffc880000000 64K RW NX SHD AF UXN MEM/NORMAL
>
> Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the
> PaX Team, Brad Spengler, and Kees Cook.
>
> Signed-off-by: David Brown <david.brown@linaro.org>
> ---
> arch/arm64/kernel/vdso/vdso.S | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S
> index 60c1db5..db7c0f2 100644
> --- a/arch/arm64/kernel/vdso/vdso.S
> +++ b/arch/arm64/kernel/vdso/vdso.S
> @@ -24,6 +24,7 @@
> __PAGE_ALIGNED_DATA
^^ You can get rid of this now as well
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>
> .globl vdso_start, vdso_end
> + .section .rodata
> .balign PAGE_SIZE
> vdso_start:
> .incbin "arch/arm64/kernel/vdso/vdso.so"
> --
> 2.7.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [kernel-hardening] [PATCH] arm64: vdso: Mark vDSO code as read-only
2016-02-11 14:19 ` [kernel-hardening] " Ard Biesheuvel
@ 2016-02-13 0:31 ` David Brown
2016-02-13 9:00 ` Ard Biesheuvel
0 siblings, 1 reply; 6+ messages in thread
From: David Brown @ 2016-02-13 0:31 UTC (permalink / raw)
To: linux-arm-kernel
On Thu, Feb 11, 2016 at 03:19:20PM +0100, Ard Biesheuvel wrote:
>> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S
>> index 60c1db5..db7c0f2 100644
>> --- a/arch/arm64/kernel/vdso/vdso.S
>> +++ b/arch/arm64/kernel/vdso/vdso.S
>> @@ -24,6 +24,7 @@
>> __PAGE_ALIGNED_DATA
>
>^^ You can get rid of this now as well
Can we? The page is getting mapped to userspace, and if we didn't
page align it, we could leak kernel read-only data to every userspace
process.
David
^ permalink raw reply [flat|nested] 6+ messages in thread
* [kernel-hardening] [PATCH] arm64: vdso: Mark vDSO code as read-only
2016-02-13 0:31 ` David Brown
@ 2016-02-13 9:00 ` Ard Biesheuvel
0 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2016-02-13 9:00 UTC (permalink / raw)
To: linux-arm-kernel
On 13 February 2016 at 01:31, David Brown <david.brown@linaro.org> wrote:
> On Thu, Feb 11, 2016 at 03:19:20PM +0100, Ard Biesheuvel wrote:
>
>>> diff --git a/arch/arm64/kernel/vdso/vdso.S
>>> b/arch/arm64/kernel/vdso/vdso.S
>>> index 60c1db5..db7c0f2 100644
>>> --- a/arch/arm64/kernel/vdso/vdso.S
>>> +++ b/arch/arm64/kernel/vdso/vdso.S
>>> @@ -24,6 +24,7 @@
>>> __PAGE_ALIGNED_DATA
>>
>>
>> ^^ You can get rid of this now as well
>
>
> Can we? The page is getting mapped to userspace, and if we didn't
> page align it, we could leak kernel read-only data to every userspace
> process.
>
That's what the .balign is for. __PAGE_ALIGNED_DATA only sets the
section, and you're overriding that right after.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] arm64: vdso: Mark vDSO code as read-only
2016-02-10 21:52 [PATCH] arm64: vdso: Mark vDSO code as read-only David Brown
2016-02-11 13:47 ` Will Deacon
2016-02-11 14:19 ` [kernel-hardening] " Ard Biesheuvel
@ 2016-02-16 18:22 ` Catalin Marinas
2 siblings, 0 replies; 6+ messages in thread
From: Catalin Marinas @ 2016-02-16 18:22 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, Feb 10, 2016 at 01:52:22PM -0800, David Brown wrote:
> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S
> index 60c1db5..db7c0f2 100644
> --- a/arch/arm64/kernel/vdso/vdso.S
> +++ b/arch/arm64/kernel/vdso/vdso.S
> @@ -24,6 +24,7 @@
> __PAGE_ALIGNED_DATA
>
> .globl vdso_start, vdso_end
> + .section .rodata
> .balign PAGE_SIZE
> vdso_start:
> .incbin "arch/arm64/kernel/vdso/vdso.so"
> --
> 2.7.1
Patch applied (and removed __PAGE_ALIGNED_DATA as well). Thanks.
--
Catalin
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-16 18:22 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-10 21:52 [PATCH] arm64: vdso: Mark vDSO code as read-only David Brown
2016-02-11 13:47 ` Will Deacon
2016-02-11 14:19 ` [kernel-hardening] " Ard Biesheuvel
2016-02-13 0:31 ` David Brown
2016-02-13 9:00 ` Ard Biesheuvel
2016-02-16 18:22 ` Catalin Marinas
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).