From: Dan Rosenberg <drosenberg@vsecurity.com>
To: Matt Mackall <mpm@selenic.com>
Cc: Pekka Enberg <penberg@kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Dave Hansen <dave@linux.vnet.ibm.com>,
Theodore Tso <tytso@mit.edu>,
cl@linux-foundation.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, Ingo Molnar <mingo@elte.hu>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH] Make /proc/slabinfo 0400
Date: Fri, 04 Mar 2011 15:42:57 -0500 [thread overview]
Message-ID: <1299271377.2071.1406.camel@dan> (raw)
In-Reply-To: <1299270709.3062.313.camel@calx>
On Fri, 2011-03-04 at 14:31 -0600, Matt Mackall wrote:
> On Fri, 2011-03-04 at 22:02 +0200, Pekka Enberg wrote:
> > On Fri, Mar 4, 2011 at 8:14 PM, Matt Mackall <mpm@selenic.com> wrote:
> > >> Of course, as you say, '/proc/meminfo' still does give you the trigger
> > >> for "oh, now somebody actually allocated a new page". That's totally
> > >> independent of slabinfo, though (and knowing the number of active
> > >> slabs would neither help nor hurt somebody who uses meminfo - you
> > >> might as well allocate new sockets in a loop, and use _only_ meminfo
> > >> to see when that allocated a new page).
> > >
> > > I think lying to the user is much worse than changing the permissions.
> > > The cost of the resulting confusion is WAY higher.
> >
> > Yeah, maybe. I've attached a proof of concept patch that attempts to
> > randomize object layout in individual slabs. I'm don't completely
> > understand the attack vector so I don't make any claims if the patch
> > helps or not.
>
> In general, the attack relies on getting an object A (vulnerable to
> overrun) immediately beneath an object B (that can be exploited when
> overrun).
>
> I'm not sure how much randomization helps, though. Allocate 1000 objects
> of type B, deallocate the 800th, then allocate an object of type A. It's
> almost certainly next to a B.
>
On second thought, this does pose a problem. Even if you don't know how
full the most recent slab is or where free vs. used chunks are within
it, if you can guarantee that you filled an entire previous slab with
your objects and then free and reallocate one of them, then you can
still win.
-Dan
> --
> Mathematics is the supreme nostalgia of our time.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2011-03-04 20:43 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-03 17:50 [PATCH] Make /proc/slabinfo 0400 Dan Rosenberg
2011-03-03 18:17 ` Dave Hansen
2011-03-03 18:29 ` Dan Rosenberg
2011-03-03 20:58 ` Matt Mackall
2011-03-03 21:16 ` Dan Rosenberg
2011-03-03 21:44 ` Matt Mackall
2011-03-03 22:30 ` Dan Rosenberg
2011-03-03 23:08 ` Matt Mackall
2011-03-04 0:32 ` Dave Hansen
2011-03-04 0:50 ` Theodore Tso
2011-03-04 6:52 ` Pekka Enberg
2011-03-04 17:36 ` Dave Hansen
2011-03-04 17:48 ` Linus Torvalds
2011-03-04 18:14 ` Matt Mackall
2011-03-04 20:02 ` Pekka Enberg
2011-03-04 20:31 ` Matt Mackall
2011-03-04 20:42 ` Dan Rosenberg [this message]
2011-03-04 20:56 ` Pekka Enberg
2011-03-04 21:08 ` Dan Rosenberg
2011-03-04 21:30 ` Pekka Enberg
2011-03-04 21:44 ` Dan Rosenberg
2011-03-04 22:10 ` Pekka Enberg
2011-03-04 22:14 ` Pekka Enberg
2011-03-04 23:02 ` Matt Mackall
2011-03-05 16:25 ` Ted Ts'o
2011-03-06 13:19 ` Alan Cox
2011-03-07 14:56 ` Dan Rosenberg
2011-03-07 16:02 ` Matt Mackall
2011-03-04 20:37 ` Dan Rosenberg
2011-03-04 20:58 ` Pekka Enberg
2011-03-04 21:10 ` Dan Rosenberg
2011-03-06 0:42 ` Jesper Juhl
2011-03-06 0:57 ` Dan Rosenberg
2011-03-06 1:09 ` Matt Mackall
2011-03-06 1:15 ` Jesper Juhl
2011-03-07 16:40 ` Christoph Lameter
2011-03-04 21:12 ` Matt Mackall
2011-03-04 11:58 ` Alan Cox
-- strict thread matches above, loose matches on Subject: below --
2011-03-07 14:19 [PATCH] Make /proc/slabinfo 040 George Spelvin
2011-03-07 17:49 ` [PATCH] Make /proc/slabinfo 0400 George Spelvin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1299271377.2071.1406.camel@dan \
--to=drosenberg@vsecurity.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux-foundation.org \
--cc=dave@linux.vnet.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mingo@elte.hu \
--cc=mpm@selenic.com \
--cc=penberg@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).