Re: [PATCH 1/2] meson: mitigate against ROP exploits with -fzero-call-used-regs

[Thomas Huth <thuth@redhat.com>]

On 05/10/2023 19.38, Daniel P. Berrangé wrote:
> To quote wikipedia:
> 
>    "Return-oriented programming (ROP) is a computer security exploit
>     technique that allows an attacker to execute code in the presence
>     of security defenses such as executable space protection and code
>     signing.
> 
>     In this technique, an attacker gains control of the call stack to
>     hijack program control flow and then executes carefully chosen
>     machine instruction sequences that are already present in the
>     machine's memory, called "gadgets". Each gadget typically ends in
>     a return instruction and is located in a subroutine within the
>     existing program and/or shared library code. Chained together,
>     these gadgets allow an attacker to perform arbitrary operations
>     on a machine employing defenses that thwart simpler attacks."
> 
> QEMU is by no means perfect with an ever growing set of CVEs from
> flawed hardware device emulation, which could potentially be
> exploited using ROP techniques.
> 
> Since GCC 11 there has been a compiler option that can mitigate
> against this exploit technique:
> 
>      -fzero-call-user-regs
> 
> To understand it refer to these two resources:
> 
>     https://www.jerkeby.se/newsletter/posts/rop-reduction-zero-call-user-regs/
>     https://gcc.gnu.org/pipermail/gcc-patches/2020-August/552262.html
> 
> I used two programs to scan qemu-system-x86_64 for ROP gadgets:
> 
>    https://github.com/0vercl0k/rp
>    https://github.com/JonathanSalwan/ROPgadget
> 
> When asked to find 8 byte gadgets, the 'rp' tool reports:
> 
>    A total of 440278 gadgets found.
>    You decided to keep only the unique ones, 156143 unique gadgets found.
> 
> While the ROPgadget tool reports:
> 
>    Unique gadgets found: 353122
> 
> With the --ropchain argument, the latter attempts to use the found
> gadgets to product a chain that can execute arbitrary syscalls. With
> current QEMU it succeeds in this task, which is an undesirable
> situation.
> 
> With QEMU modified to use -fzero-call-user-regs=used-gpr the 'rp' tool
> reports
> 
>    A total of 528991 gadgets found.
>    You decided to keep only the unique ones, 121128 unique gadgets found.
> 
> This is 22% fewer unique gadgets
> 
> While the ROPgadget tool reports:
> 
>    Unique gadgets found: 328605
> 
> This is 7% fewer unique gadgets. Crucially though, despite this more
> modest reduction, the ROPgadget tool is no longer able to identify a
> chain of gadgets for executing arbitrary syscalls. It fails at the
> very first step, unable to find gadgets for populating registers for
> a future syscall. Having said that, more advanced tools do still
> manage to put together a viable ROP chain.
> 
> Also this only takes into account QEMU code. QEMU links to many 3rd
> party shared libraries and ideally all of them would be compiled with
> this same hardening. That becomes a distro policy question though.
> 
> In terms of performance impact, TCG was used as an evaluation test
> case. We're not interested in protecting TCG since it isn't designed
> to provide a security barrier, but it is performance sensitive code,
> so useful as a guide to how other areas of QEMU might be impacted.
> With the -fzero-call-user-regs=used-gpr argument present, using the
> real world test of booting a linux kernel and having init immediately
> poweroff, there is a ~1% slow down in performance under TCG. The QEMU
> binary size also grows by approximately 1%.
> 
> By comparison, using the more aggressive -fzero-call-user-regs=all,
> results in a slowdown of over 25% in TCG, which is clearly not an
> acceptable impact, and a binary size increase of 5%.
> 
> Considering that 'used-gpr' succesfully stopped ROPgadget assembling
> a chain, this more targetted protection is a justifiable hardening
> / performance tradeoff.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   meson.build | 11 +++++++++++
>   1 file changed, 11 insertions(+)
> 
> diff --git a/meson.build b/meson.build
> index 20ceeb8158..2003ca1ba4 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -435,6 +435,17 @@ if get_option('fuzzing')
>     endif
>   endif
>   
> +# Check further flags that make QEMU more robust against malicious parties
> +
> +hardening_flags = [
> +    # Zero out registers used during a function call
> +    # upon its return. This makes it harder to assemble
> +    # ROP gadgets into something usable
> +    '-fzero-call-used-regs=used-gpr',
> +]
> +
> +qemu_common_flags += cc.get_supported_arguments(hardening_flags)

Linux kernel uses the same flag and talks about similar performance costs:

  https://github.com/torvalds/linux/commit/a82adfd5c7cb4b

So I think this should be fine fine to be used in QEMU, too.

Reviewed-by: Thomas Huth <thuth@redhat.com>