linux-kernel - Re: [PATCH] Change ZERO_SIZE_PTR to point at unmapped space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.1.10.0906021130410.23962@gentwo.org>
Date:	Tue, 2 Jun 2009 11:37:01 -0400 (EDT)
From:	Christoph Lameter <cl@...ux-foundation.org>
To:	"Larry H." <research@...reption.com>
cc:	Linus Torvalds <torvalds@...ux-foundation.org>, linux-mm@...ck.org,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Rik van Riel <riel@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Change ZERO_SIZE_PTR to point at unmapped space

On Sat, 30 May 2009, Larry H. wrote:

> Let me provide you with a realistic scenario:
>
> 	1. foo.c network protocol implementation takes a sockopt which
> 	sets some ACME_OPTLEN value taken from userland.
>
> 	2. the length is not validated properly: it can be zero or an
> 	integer overflow / signedness issue allows it to wrap to zero.
>
> 	3. kmalloc(0) ensues, and data is copied to the pointer
> 	returned. if this is the default ZERO_SIZE_PTR*, a malicious user
> 	can mmap a page at NULL, and read data leaked from kernel memory
> 	everytime that setsockopt is issued.
> 	(*: kmalloc of zero returns ZERO_SIZE_PTR)

Cannot happen. The page at 0L is not mapped. This will cause a fault.

You are assuming the system has already been breached. Then of course all
bets are off.

> The performance impact, if any, is completely negligible. The security
> benefits of this utterly simple change well surpass the downsides.

Dont see any security benefit. If there is a way to breach security
of the kernel via mmap then please tell us and then lets fix
the problem and not engage in dealing with secondary issues.

Semantics of mmap(NULL, ...) is that the kernel selects a valid address
for you. How are you mapping something at 0L?

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/