linux-kernel - Nokia N900: insecure W+X mapping at 0xd0050000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Mar 2018 15:28:18 +0100
From:   Pavel Machek <pavel@....cz>
To:     pali.rohar@...il.com, sre@...nel.org,
        kernel list <linux-kernel@...r.kernel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>,
        linux-omap@...r.kernel.org, tony@...mide.com, khilman@...nel.org,
        aaro.koskinen@....fi, ivo.g.dimitrov.75@...il.com,
        patrikbachan@...il.com, serge@...lyn.com, abcloriens@...il.com,
        clayton@...ftyguy.net, martijn@...xit.nl,
        sakari.ailus@...ux.intel.com,
        Filip Matijević <filip.matijevic.pz@...il.com>
Subject: Nokia N900: insecure W+X mapping at 0xd0050000

Hi!

Insecure W+X mappings, who cares about those? I have 7 pages...

								Pavel

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.16.0-rc3-next-20180302 (pavel@duo) (gcc
version 4.7.2 (GC
C)) #70 Fri Mar 2 10:16:00 CET 2018
[    0.000000] CPU: ARMv7 Processor [411fc083] revision 3 (ARMv7),
cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT
nonaliasing instruction cac
...
[    1.266693] ------------[ cut here ]------------
[    1.271606] WARNING: CPU: 0 PID: 1 at lib/refcount.c:187
refcount_sub_and_test+0x94/0xa8
[    1.280181] refcount_t: underflow; use-after-free.
[    1.285247] Modules linked in:
...
[    4.557220] devtmpfs: mounted
[    4.569610] Freeing unused kernel memory: 1024K
[    4.581481] ------------[ cut here ]------------
[    4.592376] WARNING: CPU: 0 PID: 1 at arch/arm/mm/dump.c:253
note_page+0x2f8/0x328
[    4.606658] arm/mm: Found insecure W+X mapping at address
0xd0050000
[    4.619781] Modules linked in:
[    4.629272] CPU: 0 PID: 1 Comm: swapper Tainted: G        W
4.16.0-rc3-next-20180302 #70
[    4.645111] Hardware name: Nokia RX-51 board
[    4.655944] [<c010d6cc>] (unwind_backtrace) from [<c010b560>]
(show_stack+0x10/0x14)
[    4.670593] [<c010b560>] (show_stack) from [<c0127dec>]
(__warn+0xe8/0x110)
[    4.684295] [<c0127dec>] (__warn) from [<c0127edc>]
(warn_slowpath_fmt+0x38/0x48)
[    4.698455] [<c0127edc>] (warn_slowpath_fmt) from [<c0113aa8>]
(note_page+0x2f8/0x328)
[    4.713134] [<c0113aa8>] (note_page) from [<c0113b60>]
(walk_pgd+0x88/0x178)
[    4.726837] [<c0113b60>] (walk_pgd) from [<c0113d28>]
(ptdump_check_wx+0x64/0xb8)
[    4.741210] [<c0113d28>] (ptdump_check_wx) from [<c0716428>]
(kernel_init+0x24/0x108)
[    4.755859] [<c0716428>] (kernel_init) from [<c01010e8>]
(ret_from_fork+0x14/0x2c)
[    4.770294] Exception stack(0xce049fb0 to 0xce049ff8)
[    4.781921] 9fa0:                                     00000000
00000000 00000000 00000000
[    4.796966] 9fc0: 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000
[    4.812011] 9fe0: 00000000 00000000 00000000 00000000 00000013
00000000
[    4.825378] ---[ end trace dcb3a72772bbfe7c ]---
[    4.837005] Checked W+X mappings: FAILED, 7 W+X pages found

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)