linux-kernel - [tip:mm/readonly] ARM/vdso: Mark the vDSO code read-only after init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 22 Feb 2016 04:20:45 -0800
From:	tip-bot for David Brown <tipbot@...or.com>@zytor.com
To:	linux-tip-commits@...r.kernel.org@...or.com
Cc:	hpa@...or.com, linux-arch@...r.kernel.org, bp@...en8.de,
	re.emese@...il.com, pageexec@...email.hu, keescook@...omium.org,
	tglx@...utronix.de, peterz@...radead.org, spender@...ecurity.net,
	mpe@...erman.id.au, mingo@...nel.org, dvlasenk@...hat.com,
	nathan_lynch@...tor.com, linux@....linux.org.uk, brgerst@...il.com,
	minipli@...glemail.com, linux-kernel@...r.kernel.org,
	torvalds@...ux-foundation.org, david.brown@...aro.org,
	luto@...capital.net, arnd@...db.de
Subject: [tip:mm/readonly] ARM/vdso: Mark the vDSO code read-only after init

Commit-ID:  11bf9b865898961cee60a41c483c9f27ec76e12e
Gitweb:     http://git.kernel.org/tip/11bf9b865898961cee60a41c483c9f27ec76e12e
Author:     David Brown <david.brown@...aro.org>
AuthorDate: Wed, 17 Feb 2016 14:41:18 -0800
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Mon, 22 Feb 2016 08:51:39 +0100

ARM/vdso: Mark the vDSO code read-only after init

Although the ARM vDSO is cleanly separated by code/data with the code
being read-only in userspace mappings, the code page is still writable
from the kernel.

There have been exploits (such as http://itszn.com/blog/?p=21) that
take advantage of this on x86 to go from a bad kernel write to full
root.

Prevent this specific exploit class on ARM as well by putting the vDSO
code page in post-init read-only memory as well.

Before:
	vdso: 1 text pages at base 80927000
	root@...press:/ cat /sys/kernel/debug/kernel_page_tables
	---[ Modules ]---
	---[ Kernel Mapping ]---
	0x80000000-0x80100000           1M     RW NX SHD
	0x80100000-0x80600000           5M     ro x  SHD
	0x80600000-0x80800000           2M     ro NX SHD
	0x80800000-0xbe000000         984M     RW NX SHD

After:
	vdso: 1 text pages at base 8072b000
	root@...press:/ cat /sys/kernel/debug/kernel_page_tables
	---[ Modules ]---
	---[ Kernel Mapping ]---
	0x80000000-0x80100000           1M     RW NX SHD
	0x80100000-0x80600000           5M     ro x  SHD
	0x80600000-0x80800000           2M     ro NX SHD
	0x80800000-0xbe000000         984M     RW NX SHD

Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the
PaX Team, Brad Spengler, and Kees Cook.

Signed-off-by: David Brown <david.brown@...aro.org>
Signed-off-by: Kees Cook <keescook@...omium.org>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Brad Spengler <spender@...ecurity.net>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Denys Vlasenko <dvlasenk@...hat.com>
Cc: Emese Revfy <re.emese@...il.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Mathias Krause <minipli@...glemail.com>
Cc: Michael Ellerman <mpe@...erman.id.au>
Cc: Nathan Lynch <nathan_lynch@...tor.com>
Cc: PaX Team <pageexec@...email.hu>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Russell King <linux@....linux.org.uk>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: kernel-hardening@...ts.openwall.com
Cc: linux-arch <linux-arch@...r.kernel.org>
Cc: linux-arm-kernel@...ts.infradead.org
Cc: linux-kernel@...r.kernel.org
Link: http://lkml.kernel.org/r/1455748879-21872-8-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/arm/vdso/vdso.S | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/vdso/vdso.S b/arch/arm/vdso/vdso.S
index b2b97e3..a62a7b6 100644
--- a/arch/arm/vdso/vdso.S
+++ b/arch/arm/vdso/vdso.S
@@ -23,9 +23,8 @@
 #include <linux/const.h>
 #include <asm/page.h>
 
-	__PAGE_ALIGNED_DATA
-
 	.globl vdso_start, vdso_end
+	.section .data..ro_after_init
 	.balign PAGE_SIZE
 vdso_start:
 	.incbin "arch/arm/vdso/vdso.so"