linux-kernel - Re: [PATCH v4 09/10] x86-64: Randomize int 0xcc magic al values at boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110531154012.GB30353@elte.hu>
Date:	Tue, 31 May 2011 17:40:12 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Andy Lutomirski <luto@....EDU>
Cc:	x86@...nel.org, Thomas Gleixner <tglx@...utronix.de>,
	linux-kernel@...r.kernel.org, Jesper Juhl <jj@...osbits.net>,
	Borislav Petkov <bp@...en8.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Arjan van de Ven <arjan@...radead.org>,
	Jan Beulich <JBeulich@...ell.com>,
	richard -rw- weinberger <richard.weinberger@...il.com>,
	Mikael Pettersson <mikpe@...uu.se>,
	Andi Kleen <andi@...stfloor.org>
Subject: Re: [PATCH v4 09/10] x86-64: Randomize int 0xcc magic al values at
 boot


* Andy Lutomirski <luto@....EDU> wrote:

> This is not a security feature.  It's to prevent the int 0xcc
> sequence from becoming ABI.

Hm, what kind of ABI reliance could be built on it?

> +static void __init mangle_vsyscall_movb(void *mapping,
> +					unsigned long movb_addr, u8 initial)
> +{
> +	u8 *imm8;
> +	BUG_ON(movb_addr >= 4095);

Please put newlines after local variable definitions.

>  static int __init vsyscall_init(void)
>  {
> +	extern char __vsyscall_0;

Please don't put extern definitions in the middle of a .c file - if 
then it should be in a .h file. (even if only a single function uses 
it)

> +	/*
> +	 * Randomize the magic al values for int 0xcc invocation.  This
> +	 * isn't really a security feature; it's to make sure that
> +	 * dynamic binary instrumentation tools don't start to think
> +	 * that the int 0xcc magic incantation is ABI.
> +	 */
> +	vsyscall_nr_offset = get_random_int() % 3;
> +	vsyscall_page = pfn_to_page(__pa_symbol(&__vsyscall_0) >> PAGE_SHIFT);
> +	mapping = kmap_atomic(vsyscall_page);
> +	/* It's easier to hardcode the addresses -- they're ABI. */
> +	mangle_vsyscall_movb(mapping, 0, 0xcc);

what about filling it with zeroes?

> +#ifndef CONFIG_UNSAFE_VSYSCALLS
> +	mangle_vsyscall_movb(mapping, 1024, 0xce);
> +#endif
> +	mangle_vsyscall_movb(mapping, 2048, 0xf0);

Dunno, this all looks rather ugly.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/