linux-kernel - Re: mmap_min_addr and your local LSM (ok, just SELinux)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090728112137.GF15310@basil.fritz.box>
Date:	Tue, 28 Jul 2009 13:21:37 +0200
From:	Andi Kleen <andi@...stfloor.org>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	Andi Kleen <andi@...stfloor.org>, James Morris <jmorris@...ei.org>,
	James Carter <jwcart2@...ho.nsa.gov>,
	Eric Paris <eparis@...hat.com>, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov,
	Stephen Smalley <sds@...ho.nsa.gov>, spender@...ecurity.net,
	Daniel J Walsh <dwalsh@...hat.com>, cl@...ux-foundation.org,
	Arjan van de Ven <arjan@...radead.org>, kees@...flux.net,
	Chad Sellers <csellers@...sys.com>,
	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
	mingo@...e.hu
Subject: Re: mmap_min_addr and your local LSM (ok, just SELinux)

On Tue, Jul 28, 2009 at 11:00:28AM +0100, Alan Cox wrote:
> On Tue, 28 Jul 2009 11:21:29 +0200
> Andi Kleen <andi@...stfloor.org> wrote:
> 
> > Alan Cox <alan@...rguk.ukuu.org.uk> writes:
> > 
> > > A dumb question perhaps, but while addling my brain over the tty layer I
> > > was wondering if for the specific case of jump through NULL (which seems
> > > to be the most common but by no means only problem case that gets
> > > exploited) is there any reason we can't set a default breakpoint for
> > 
> > You mean a hardware breakpoint? Hardware break points are a precious
> > scarce resource. The people who rely on them would be likely
> > unhappy if you take one way from them.
> 
> They are a tiny minority and could always turn such protection off.

"I don't use it so I don't care"

... in addition it doesn't help anyways because the x86 hardware
breakpoints can only trap an upto 4-8 bytes area. So if you set that
to 0 then a reference to >8(%reg),%reg==0 wouldn't trap.

That's a pretty common case with

	x->member

where offsetof(..,, member) >= 8 (or 4 on 32bit)

Was very likely even the case on the original exploit.

If you use all available break points (making all gdb users unhappy)
then you could still only cover 64 bytes on 64bit, 32 on 32bit.

-Andi

-- 
ak@...ux.intel.com -- Speaking for myself only.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/