linux-kernel - Re: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5503089F.9000405@sr71.net>
Date:	Fri, 13 Mar 2015 08:56:15 -0700
From:	Dave Hansen <dave@...1.net>
To:	Andrew Morton <akpm@...ux-foundation.org>
CC:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Kees Cook <keescook@...omium.org>, tytso@....edu,
	Oleg Nesterov <oleg@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface

On 03/12/2015 03:35 PM, Andrew Morton wrote:
> On Mon, 09 Mar 2015 13:43:21 -0700 Dave Hansen <dave@...1.net> wrote:
>> From: Dave Hansen <dave.hansen@...ux.intel.com>
>>
>> Physical addresses are sensitive information.  There are
>> existing, known exploits that are made easier if physical
>> information is available.  Here is one example:
>>
>> 	http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf
> Do we really need to disable pagemap entirely?  What happens if we just
> obscure the addresses (ie: zero them)?

I think we have 3 basic options:

1.  Disable it entirely (-EPERM or whatever).  Apps using it break
    quickly and fairly obviously (diagnosable with an strace)
2.  Zero it, or return some nonsensical thing for the physical address
    portion, but maintain exporting the PTE flags.  Apps only caring
    about PTE flags work, but anything trying to do lookups in
    /proc/kpageflags break.  If we zero it, apps pay get confused
    thinking they have the _actual_ pfn=0.
3.  Scramble it in some way obscuring the physical address.  Unscramble
    it upon access to /proc/kpageflags.

I think you're suggesting (2).  Doesn't that risk silently breaking apps?

>> pagemap is also the kind of feature that could be used to escalate
>> privileged from root in to the kernel.  It probably needs to be
>> protected in the same way that /dev/mem or module loading is in
>> cases where the kernel needs to be protected from root, thus the
>> choice to use CAP_SYS_RAWIO.
> 
> Confused.  If you have root, you can do mount -o notparanoid.

Good point.  I guess it doesn't protect us much here unless we also
restrict the ability to remount.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/