linux-kernel - new module to check constant memory for corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <trinity-aef9715a-72d2-4824-a3d8-306d5850c633-1397352790457@3capp-gmx-bs18>
Date:	Sun, 13 Apr 2014 03:33:10 +0200
From:	Alexander.Kleinsorge@....de
To:	linux-kernel@...r.kernel.org
Subject: new module to check constant memory for corruption

ramcheck kernel module
new module to check constant memory for corruption

detect corruption of constant kernel memory (text and data) periodically.
runtime costs about 1..2 ms per sec (about 10 mb with 5 mb/ms),
which is distributed over 8 (BLOCKS) time partitions (less than half ms per sec).
in case of checksum (xor) error, an kernel log is posted.
manual trigger via /proc/ramcheck is possible.
range: kallsyms_lookup_name("_text") .. kallsyms_lookup_name("__end_rodata")

this new module helps against two scenarios:
1) bit flip on system without crc (typical pc)

more often than you think:
DRAM Errors in the Wild: A Large-Scale Field Study, Mai 2009.
http://www.cs.toronto.edu/~bianca/papers/sigmetrics09.pdf

2) architectures without memory protection plus attack or out-of-bound-writes.
x86 and x64 using it (write protection), but missing (or not enabled) on most other arch.

see: ramcheck.tgz

Download attachment "ramcheck.tgz" of type "application/octet-stream" (4206 bytes)

View attachment "ramcheck.c" of type "text/plain" (9615 bytes)