linux-kernel - Re: [PATCH 1/3] x86: routines to choose random kernel base offset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 5 Apr 2013 09:24:05 +0200
From:	Ingo Molnar <mingo@...nel.org>
To:	Kees Cook <keescook@...omium.org>
Cc:	linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
	"H. Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
	Jarkko Sakkinen <jarkko.sakkinen@...el.com>,
	Matthew Garrett <mjg@...hat.com>,
	Matt Fleming <matt.fleming@...el.com>,
	Eric Northup <digitaleric@...gle.com>,
	Dan Rosenberg <drosenberg@...curity.com>,
	Julien Tinnes <jln@...gle.com>, Will Drewry <wad@...omium.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 1/3] x86: routines to choose random kernel base offset

* Kees Cook <keescook@...omium.org> wrote:

> This provides routines for selecting a randomized kernel base offset, 
> bounded by e820 details. It tries to use RDRAND and falls back to RDTSC. 
> If "noaslr" is on the kernel command line, no offset will be used.

Would it make sense to also add three other sources of entropy:

---------

1)

  CMOS_READ(RTC_SECONDS);

The exact second the bootup occured might not be known to the attacker, so 
this could add a bit or two of entropy even in the worst case where the 
attacker has access to precise 'uptime' and system log information and 
there's no NTP active that fudges the offsets.

If the attacker is most restricted, in the sandboxed case, then this could 
add a fair amount of entropy.

2)

Another source of per system entropy would be to simply mix all e820 
entries into the random offset - we already parse them to place the kernel 
image.

The e820 info changes per system type, amount of RAM and devices 
installed.

Especially in a restricted remote environment the attacker might not know 
the hardware details and the e820 map.

3)

A build time random bit. This is essentially per system as well if the 
attacker does not know the precise kernel version, or if the kernel was 
custom built.

---------

In the worst case an attacker can guess all of these bits - but 
statistically it still improves entropy for the general Linux box that 
gets attacked.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/