linux-kernel - Re: [kernel-hardening] Re: Add overflow protection to kref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 24 Feb 2012 22:58:25 +0400
From:	Vasiliy Kulikov <segoon@...nwall.com>
To:	Greg KH <gregkh@...uxfoundation.org>
Cc:	David Windsor <dwindsor@...il.com>,
	Roland Dreier <roland@...estorage.com>,
	Djalal Harouni <tixxdz@...ndz.org>,
	kernel-hardening@...ts.openwall.com,
	Kees Cook <keescook@...omium.org>,
	Ubuntu security discussion <ubuntu-hardened@...ts.ubuntu.com>,
	linux-kernel@...r.kernel.org, pageexec@...email.hu,
	spender@...ecurity.net
Subject: Re: [kernel-hardening] Re: Add overflow protection to kref

On Fri, Feb 24, 2012 at 10:37 -0800, Greg KH wrote:
> On Fri, Feb 24, 2012 at 12:58:35PM -0500, David Windsor wrote:
> >  static inline void kref_get(struct kref *kref)
> >  {
> > +   int rc = 0;
> >     WARN_ON(!atomic_read(&kref->refcount));
> > -   atomic_inc(&kref->refcount);
> > +   smp_mb__before_atomic_inc();
> > +   rc = atomic_add_unless(&kref->refcount, 1, INT_MAX);
> > +   smp_mb__after_atomic_inc();
> > +   BUG_ON(!rc);
> 
> So you are guaranteeing to crash a machine here if this fails?  And you
> were trying to say this is a "security" based fix?
> 
> And people wonder why I no longer have any hair...

If a refcounter overflows there is NO WAY to recover.  The choise is to BUG()
and not allow any security harm to the system (privilege escalation, etc.)
or to try to do some more CPU cycles until actual use after free, privilege
escalation, etc.  The former is a _guarantee_ that nothing bad (in security
sense) doesn't happen.  The latter is an opportunistic approach, which
doesn't work with security.

Do you claim that a refcounter overflow is a recoverable state?  I'd want to
know what you can do with it.

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/