public inbox for linux-mips@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] MIPS: Prevent READ_IMPLIES_EXEC propagation
@ 2020-07-07  9:39 Tiezhu Yang
  2020-07-07 19:45 ` Maciej W. Rozycki
                   ` (2 more replies)
  0 siblings, 3 replies; 9+ messages in thread
From: Tiezhu Yang @ 2020-07-07  9:39 UTC (permalink / raw)
  To: Thomas Bogendoerfer
  Cc: linux-mips, linux-kernel, Kees Cook, Xuefeng Li, Juxin Gao

In the MIPS architecture, we should clear the security-relevant
flag READ_IMPLIES_EXEC in the function SET_PERSONALITY2() of the
file arch/mips/include/asm/elf.h.

Otherwise, with this flag set, PROT_READ implies PROT_EXEC for
mmap to make memory executable that is not safe, because this
condition allows an attacker to simply jump to and execute bytes
that are considered to be just data [1].

In mm/mmap.c:
unsigned long do_mmap(struct file *file, unsigned long addr,
			unsigned long len, unsigned long prot,
			unsigned long flags, vm_flags_t vm_flags,
			unsigned long pgoff, unsigned long *populate,
			struct list_head *uf)
{
	[...]
	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
		if (!(file && path_noexec(&file->f_path)))
			prot |= PROT_EXEC;
	[...]
}

By the way, x86 and ARM64 have done the similar thing.

After commit 250c22777fe1 ("x86_64: move kernel"), in the file
arch/x86/kernel/process_64.c:
void set_personality_64bit(void)
{
	[...]
	current->personality &= ~READ_IMPLIES_EXEC;
}

After commit 48f99c8ec0b2 ("arm64: Preventing READ_IMPLIES_EXEC
propagation"), in the file arch/arm64/include/asm/elf.h:
#define SET_PERSONALITY(ex)						\
({									\
	clear_thread_flag(TIF_32BIT);					\
	current->personality &= ~READ_IMPLIES_EXEC;			\
})

[1] https://insights.sei.cmu.edu/cert/2014/02/feeling-insecure-blame-your-parent.html

Reported-by: Juxin Gao <gaojuxin@loongson.cn>
Co-developed-by: Juxin Gao <gaojuxin@loongson.cn>
Signed-off-by: Juxin Gao <gaojuxin@loongson.cn>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 arch/mips/include/asm/elf.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index 5aa29ce..71c7622 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -410,6 +410,7 @@ do {									\
 	clear_thread_flag(TIF_32BIT_FPREGS);				\
 	clear_thread_flag(TIF_HYBRID_FPREGS);				\
 	clear_thread_flag(TIF_32BIT_ADDR);				\
+	current->personality &= ~READ_IMPLIES_EXEC;			\
 									\
 	if ((ex).e_ident[EI_CLASS] == ELFCLASS32)			\
 		__SET_PERSONALITY32(ex, state);				\
-- 
2.1.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2020-07-18  4:46 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-07  9:39 [PATCH] MIPS: Prevent READ_IMPLIES_EXEC propagation Tiezhu Yang
2020-07-07 19:45 ` Maciej W. Rozycki
2020-07-08  7:51   ` Tiezhu Yang
2020-07-17 10:00     ` Maciej W. Rozycki
2020-07-18  0:04       ` YunQiang Su
2020-07-18  3:59         ` Tiezhu Yang
2020-07-18  4:45           ` YunQiang Su
2020-07-08 23:26 ` Kees Cook
2020-07-16 11:59 ` Thomas Bogendoerfer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox