linux-kernel - Re: vmsplice exploits, stack protector and Makefiles

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080212185012.GA2348@uranus.ravnborg.org>
Date:	Tue, 12 Feb 2008 19:50:12 +0100
From:	Sam Ravnborg <sam@...nborg.org>
To:	Arjan van de Ven <arjan@...radead.org>
Cc:	linux-kernel@...r.kernel.org, mingo@...e.hu,
	torvalds@...ux-foundation.org
Subject: Re: vmsplice exploits, stack protector and Makefiles

On Tue, Feb 12, 2008 at 09:00:01AM -0800, Arjan van de Ven wrote:
> 
> Hi,
> 
> I just read the excellent LWN writeup of the vmsplice security thing, and that got me
> wondering why this attack wasn't stopped by the CONFIG_CC_STACKPROTECTOR option... because
> it plain should have been...
> 
> some analysis later.. it turns out that the following line in the top level Makefile,
> added by you in October 2007, entirely disables CONFIG_CC_STACKPROTECTOR ;(
> With this line removed the exploit will be nicely stopped.
> 
> # Force gcc to behave correct even for buggy distributions
> CFLAGS          += $(call cc-option, -fno-stack-protector)
> 
> 
> Now I realize that certain distros have patched gcc to compensate for their lack of distro
> wide CFLAGS, and it's great to work around that... but would there be a way to NOT
> disable this for CONFIG_CC_STACKPROTECTOR please? It would have made this
> exploit not possible for those kernels that enable this feature (and that includes distros
> like Fedora)

I guess the problem is that we in arch/x86/Makefile enable the stackprotector
but then later in the main Makefile disables it.
So the right way to approach this should be to always disable it and the reenable it in
the arch Makefile.
So something like this?

	Sam

diff --git a/Makefile b/Makefile
index c162370..7ccf6f5 100644
--- a/Makefile
+++ b/Makefile
@@ -507,6 +507,9 @@ else
 KBUILD_CFLAGS	+= -O2
 endif
 
+# Force gcc to behave correct even for buggy distributions
+KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
+
 include $(srctree)/arch/$(SRCARCH)/Makefile
 
 ifdef CONFIG_FRAME_POINTER
@@ -525,9 +528,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
 KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
 endif
 
-# Force gcc to behave correct even for buggy distributions
-KBUILD_CFLAGS         += $(call cc-option, -fno-stack-protector)
-
 # arch Makefile may override CC so keep this after arch Makefile is included
 NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
 CHECKFLAGS     += $(NOSTDINC_FLAGS)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/