linux-kernel - Re: [PATCH v4 0/6] Micro-optimize vclock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110517113634.GC13475@elte.hu>
Date:	Tue, 17 May 2011 13:36:34 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Andrew Lutomirski <luto@....edu>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Andi Kleen <andi@...stfloor.org>, x86@...nel.org,
	linux-kernel@...r.kernel.org,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <eric.dumazet@...il.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Borislav Petkov <bp@...64.org>
Subject: Re: [PATCH v4 0/6] Micro-optimize vclock_gettime


* Andrew Lutomirski <luto@....edu> wrote:

> > Well, how does that differ from having the real syscall instruction there? 
> > How are we going to filter real (old-)glibc calls from exploits?
> 
> Because there are only four vsyscalls: vgettimeofday, vtime, vgetcpu, and 
> venosys.  None of them have side-effects, so they only allow an attacker to 
> write something to user memory somewhere.  The implementation of 
> vgettimeofday needs a syscall instruction internally for its fallback, which 
> means that an attack could jump there instead of to the start of the vsyscall 
> implementation.

So for this to work securely the emulation code would also have to filter the 
syscall numbers, to make sure that only these benign syscalls are used.

It should perhaps also warn if it notices something weird going on.

> > If it can be filtered in a meaningful way then we should just do that and 
> > perhaps offer a (default enabled) .config COMPAT_VDSO_EMU=y switch to turn 
> > the emulation off.
> >
> > That way we keep the ABI and also have a way out for users who *really* 
> > need this to work in a performant way.
> 
> Yeah, that probably makes more sense.  It'll make for an uglier diffstat, 
> though -- there's a lot of ugly duplicate code around to make vgettimeofday 
> and vgetcpu work.

Lets try the pure emulation thing first, ok? Complications is not really what 
we need in this area ...

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/