linux-kernel - Re: Kernel vs user memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3e8340491003181806t201218acod8ea408d1993cbfc@mail.gmail.com>
Date:	Thu, 18 Mar 2010 21:06:12 -0400
From:	Bryan Donlan <bdonlan@...il.com>
To:	Siddhartha Chhabra <siddhartha.chhabra@...il.com>
Cc:	LKML <linux-kernel@...r.kernel.org>
Subject: Re: Kernel vs user memory

On Thu, Mar 18, 2010 at 20:47, Siddhartha Chhabra
<siddhartha.chhabra@...il.com> wrote:
> On Thu, Mar 18, 2010 at 8:28 PM, Bryan Donlan <bdonlan@...il.com> wrote:
>>
>> > If the kernel's doing a copy_from_user or copy_to_user family of calls
>> > (ie, the calls used in system call handlers when accessing user space
>> > buffers referenced in the arguments), this will trigger a page fault
>> > exactly like the userspace process would, and the PF handler will then
>> > deal with any copy on write or whatever may be needed. Of course, if a
>> > userspace access wouldn't trigger a PF, the kernel access won't
>> > either.
>>
>> > For the actual copy-on-write process itself, it would be a Bad Thing
>> > to trigger a recursive page fault, so instead the kernel will directly
>> > access the page via the direct mapped section of the address space -
>> > this will never cause a PF (on x86, this may require creating a
>> > temporary mapping for memory at a high physical address, but this
>> > still won't be a PF as it will be set up before the first access).
>> > Additionally, memory mapped IO involves direct DMA to/from pages that
>> > are simultaneously in use by userspace - this won't cause a PF in
>> > kernel mode either. Same with swap.
>>
>> > In short, some kernel accesses to user space do go through normal
>> > channels which may or may not PF; other accesses will never PF. So
>> > it's a bad idea to rely on all kernel accesses triggering a page
>> > fault.
>
>
>>
>> > Hope this helps,
>>
>> > Bryan
>
> In other words, without tying the kernel access to any specific operation
> (like COW, or copy-from/to-user, DMA, Memory mapped IO etc.), is it safe to
> say that a possibly compromised kernel wanting to read application's pages
> can do so without mapping the page to its address space, that is, without
> resulting in a page fault in the kernel mode on an attempt to access a page
> ?
>
> For example:
>
> Lets say for App A frame 5 on physical memory is mapped to its address space
> and its currently using it. The OS does a context switch, however, A's
> frames are still in the main memory. Now can the OS read these page frames
> (frame 5 in main memory) without mapping them to its address space, maybe
> just to read the application's contents and send it out to a potential
> attacker wanting to compromise the system's security ?

That is correct. The kernel can avoid a PF if it wants to by ensuring
the page tables are set up properly from the start; and physical
addresses below a certain value (which varies by architecture) can be
accessed directly without any setup at all.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/