linux-kernel - Re: [Security] [PATCH] proc: avoid information leaks to non-privileged processes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 May 2009 11:10:30 -0500
From:	Matt Mackall <mpm@...enic.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>, security@...nel.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Eric Paris <eparis@...hat.com>, Jake Edge <jake@....net>,
	linux-security-module@...r.kernel.org, mingo@...hat.com,
	Roland McGrath <roland@...hat.com>,
	James Morris <jmorris@...ei.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Arjan van de Ven <arjan@...radead.org>
Subject: Re: [Security] [PATCH] proc: avoid information leaks to non-privileged processes

On Tue, May 05, 2009 at 08:17:43AM -0700, Linus Torvalds wrote:
> 
> 
> On Tue, 5 May 2009, Eric W. Biederman wrote:
> > 
> > Yes, not mixing the result back (which would give us some kind of
> > pseudo random number generator) is the problem.
> 
> Guys, so how about this?
> 
> It's a really simple patch that basically just open-codes the current 
> "secure_ip_id()" call, but when open-coding it we now use a _static_ 
> hashing area, so that it gets updated every time.
> 
> And to make sure somebody can't just start from the same original seed of 
> all-zeroes, and then do the "half_md4_transform()" over and over until 
> they get the same sequence as the kernel has, each iteration also mixes in 
> the same old "current->pid + jiffies" we used - so we should now have a 
> regular strong pseudo-number generator, but we also have one that doesn't 
> have a single seed.
> 
> Note: the "pid + jiffies" is just meant to be a tiny tiny bit of noise. It 
> has no real meaning. It could be anything. I just picked the previous 
> seed, it's just that now we keep the state in between calls and that will 
> feed into the next result, and that should make all the difference.
> 
> I made that hash be a per-cpu data just to avoid cache-line ping-pong: 
> having multiple CPU's write to the same data would be fine for randomness, 
> and add yet another layer of chaos to it, but since get_random_int() is 
> supposed to be a fast interface I did it that way instead. I considered 
> using "__raw_get_cpu_var()" to avoid any preemption overhead while still 
> getting the hash be _mostly_ ping-pong free, but in the end good taste won 
> out.

It's an ok model, but I'd be much happier if we used a decent
hash function. I'm not a cryptanalyst, so I can't rattle off all the
known attacks against this hash function, but it can no longer be
considered any kind of cryptographic primitive. I would not be at all
surprised if it was possible to recover the entire secret state by
observing some small set of RNG outputs and then use that to backtrack
the RNG to reveal the layout of a recently launched process.

(Sending off a couple queries to some folks who are good at breaking
such things to confirm my hunches.)

Also, the current function name must go. It is seriously misleading.
get_random_u32 please.

-- 
Mathematics is the supreme nostalgia of our time.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/