linux-kernel - Re: [kernel-hardening] Re: [PATCH v9 1/4] syscalls: Verify address limit before returning to user-mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170512202106.GO22219@n2100.armlinux.org.uk>
Date:   Fri, 12 May 2017 21:21:06 +0100
From:   Russell King - ARM Linux <linux@...linux.org.uk>
To:     Kees Cook <keescook@...omium.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Mark Rutland <mark.rutland@....com>,
        Kernel Hardening <kernel-hardening@...ts.openwall.com>,
        Greg KH <greg@...ah.com>,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        LKML <linux-kernel@...r.kernel.org>,
        David Howells <dhowells@...hat.com>,
        Dave Hansen <dave.hansen@...el.com>,
        "H . Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...nel.org>,
        Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
        linux-s390 <linux-s390@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>,
        Will Deacon <will.deacon@....com>,
        Christian Borntraeger <borntraeger@...ibm.com>,
        René Nyffenegger <mail@...enyffenegger.ch>,
        Catalin Marinas <catalin.marinas@....com>,
        "Paul E . McKenney" <paulmck@...ux.vnet.ibm.com>,
        Rik van Riel <riel@...hat.com>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>,
        Arnd Bergmann <arnd@...db.de>, Brian Gerst <brgerst@...il.com>,
        Borislav Petkov <bp@...en8.de>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andy Lutomirski <luto@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Linux API <linux-api@...r.kernel.org>,
        Oleg Nesterov <oleg@...hat.com>,
        Daniel Micay <danielmicay@...il.com>,
        James Morse <james.morse@....com>,
        "Eric W . Biederman" <ebiederm@...ssion.com>,
        Martin Schwidefsky <schwidefsky@...ibm.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Thomas Garnier <thgarnie@...gle.com>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>
Subject: Re: [kernel-hardening] Re: [PATCH v9 1/4] syscalls: Verify address
 limit before returning to user-mode

On Fri, May 12, 2017 at 12:30:02PM -0700, Kees Cook wrote:
> I'm clearly not explaining things well enough. I shouldn't say
> "corruption", I should say "malicious manipulation". The methodology
> of attacks against the stack are quite different from the other kinds
> of attacks like use-after-free, heap overflow, etc. Being able to
> exhaust the kernel stack (either due to deep recursion or unbounded
> alloca())

I really hope we don't have alloca() use in the kernel.  Do you have
evidence to support that assertion?

IMHO alloca() (or similar) should not be present in any kernel code
because we have a limited stack - we have kmalloc() etc for that kind
of thing.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.