linux-kernel - Re: [PATCH] Make /proc/slabinfo 0400

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1299272907.2071.1415.camel@dan>
Date:	Fri, 04 Mar 2011 16:08:27 -0500
From:	Dan Rosenberg <drosenberg@...curity.com>
To:	Pekka Enberg <penberg@...nel.org>
Cc:	Matt Mackall <mpm@...enic.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Dave Hansen <dave@...ux.vnet.ibm.com>,
	Theodore Tso <tytso@....edu>, cl@...ux-foundation.org,
	linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	Ingo Molnar <mingo@...e.hu>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] Make /proc/slabinfo 0400

On Fri, 2011-03-04 at 22:56 +0200, Pekka Enberg wrote:
> On Fri, 2011-03-04 at 14:31 -0600, Matt Mackall wrote:
> >> On Fri, 2011-03-04 at 22:02 +0200, Pekka Enberg wrote:
> >> > On Fri, Mar 4, 2011 at 8:14 PM, Matt Mackall <mpm@...enic.com> wrote:
> >> > >> Of course, as you say, '/proc/meminfo' still does give you the trigger
> >> > >> for "oh, now somebody actually allocated a new page". That's totally
> >> > >> independent of slabinfo, though (and knowing the number of active
> >> > >> slabs would neither help nor hurt somebody who uses meminfo - you
> >> > >> might as well allocate new sockets in a loop, and use _only_ meminfo
> >> > >> to see when that allocated a new page).
> >> > >
> >> > > I think lying to the user is much worse than changing the permissions.
> >> > > The cost of the resulting confusion is WAY higher.
> >> >
> >> > Yeah, maybe. I've attached a proof of concept patch that attempts to
> >> > randomize object layout in individual slabs. I'm don't completely
> >> > understand the attack vector so I don't make any claims if the patch
> >> > helps or not.
> >>
> >> In general, the attack relies on getting an object A (vulnerable to
> >> overrun) immediately beneath an object B (that can be exploited when
> >> overrun).
> >>
> >> I'm not sure how much randomization helps, though. Allocate 1000 objects
> >> of type B, deallocate the 800th, then allocate an object of type A. It's
> >> almost certainly next to a B.
> 
> On Fri, Mar 4, 2011 at 10:42 PM, Dan Rosenberg <drosenberg@...curity.com> wrote:
> > On second thought, this does pose a problem.  Even if you don't know how
> > full the most recent slab is or where free vs. used chunks are within
> > it, if you can guarantee that you filled an entire previous slab with
> > your objects and then free and reallocate one of them, then you can
> > still win.
> 
> Guys, I still don't get it, sorry.
> 
> Why can you still win? With my patch, reallocation shouldn't matter;
> the freelist randomization ought to make it less likely for *any* two
> allocated objects to be adjacent.
> 

I could be mistaken on this, so feel free to correct me.  What if you
just fill more than one slab with the object you'd like to overflow
into, then pick an object that's guaranteed to reside in a slab filled
with your objects.  Upon freeing that object and allocating a new
to-be-overflowed object (that's sized so it's handled by the same slab
cache), this new object will be guaranteed to be sitting immediately
before one of your objects (or before the end of the slab if you're
unlucky).  You can still win because it doesn't matter which specific
object you overflow, only that you overflow one of them.

-Dan


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/