linux-hardening - Re: [PATCH v7 0/6] mm/memfd: introduce MFD_NOEXEC_SEAL and MFD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Dec 2022 13:15:03 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     jeffxu@...omium.org
Cc:     skhan@...uxfoundation.org, keescook@...omium.org,
        akpm@...ux-foundation.org, dmitry.torokhov@...il.com,
        dverkamp@...omium.org, hughd@...gle.com, jeffxu@...gle.com,
        jorgelo@...omium.org, linux-kernel@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-mm@...ck.org,
        jannh@...gle.com, linux-hardening@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: Re: [PATCH v7 0/6] mm/memfd: introduce MFD_NOEXEC_SEAL and MFD_EXEC

On Fri, Dec 9, 2022 at 11:05 AM <jeffxu@...omium.org> wrote:
> From: Jeff Xu <jeffxu@...gle.com>
>
> Since Linux introduced the memfd feature, memfd have always had their
> execute bit set, and the memfd_create() syscall doesn't allow setting
> it differently.
>
> However, in a secure by default system, such as ChromeOS, (where all
> executables should come from the rootfs, which is protected by Verified
> boot), this executable nature of memfd opens a door for NoExec bypass
> and enables “confused deputy attack”.  E.g, in VRP bug [1]: cros_vm
> process created a memfd to share the content with an external process,
> however the memfd is overwritten and used for executing arbitrary code
> and root escalation. [2] lists more VRP in this kind.

...

> [1] https://crbug.com/1305411

Can you make this accessible so those of us on the public lists can
view this bug?  If not, please remove it from future postings and
adjust your description accordingly.

-- 
paul-moore.com