linux-kernel - RE: [PATCH] printk: introduce kptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <476DC76E7D1DF2438D32BFADF679FC561CD14812@ORSMSX103.amr.corp.intel.com>
Date:   Thu, 6 Oct 2016 14:59:54 +0000
From:   "Roberts, William C" <william.c.roberts@...el.com>
To:     Christoph Hellwig <hch@...radead.org>
CC:     "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>,
        "corbet@....net" <corbet@....net>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] printk: introduce kptr_restrict level 3

> -----Original Message-----
> From: Christoph Hellwig [mailto:hch@...radead.org]
> Sent: Thursday, October 6, 2016 9:56 AM
> To: Roberts, William C <william.c.roberts@...el.com>
> Cc: Christoph Hellwig <hch@...radead.org>; kernel-
> hardening@...ts.openwall.com; corbet@....net; linux-doc@...r.kernel.org;
> linux-kernel@...r.kernel.org
> Subject: Re: [PATCH] printk: introduce kptr_restrict level 3
> 
> On Thu, Oct 06, 2016 at 01:47:47PM +0000, Roberts, William C wrote:
> > Out of tree modules still affect core kernel security.
> 
> So don't use them.
> 
> > I would also bet money, that somewhere In-tree someone has put a %p
> > when they wanted a %pK.
> 
> So fix them.

As Jann Horn points out, "And in total, there are 13578 matches for %p[^FfSsBRrhbMmIiEUVKNadCDgG] throughout the kernel. Reviewing all of those manually would suck."

> 
> > So this method is just quite error
> > prone. We currently have a blacklist approach versus whitelist.
> 
> Or fix the entire thing, get rid of %pK and always protect %p if you can show that
> it doesn't break anything.
> 
> But stop posting patches with bullshit arguments like out of tree modules.

Ok perhaps the commit message sucks, and I should have included the large spread usages of %p throughout
the kernel, I assumed those would just be known, I shouldn't have made that assumption.

We should care about out-of-tree modules wrt security as they affect the security of the whole system, especially when the
modules are linking to core symbols like printing and string routines. There are tons of %p usages throughout the
kernel as noted above.

This is pretty low hanging fruit and we should fix this, as Kees points out.