linux-kernel - Re: [RFC][PATCH] timer: Add function-change canary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 8 Aug 2017 10:59:49 -0700
From:   Kees Cook <keescook@...omium.org>
To:     "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        John Stultz <john.stultz@...aro.org>,
        Stephen Boyd <sboyd@...eaurora.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC][PATCH] timer: Add function-change canary

On Mon, Aug 7, 2017 at 5:33 PM, Kees Cook <keescook@...omium.org> wrote:
> This introduces canaries to struct timer_list in an effort to protect the
> function callback pointer from getting rewritten during stack or heap
> overflow attacks. The struct timer_list has become a recent target for
> security flaw exploitation because it includes the "data" argument in
> the structure, along with the function callback. This provides attackers
> with a ROP-like primitive for performing limited kernel function calls
> without needing all the prerequisites to stage a ROP attack.
>
> Recent examples of exploits using struct timer_list attacks:
>
> http://www.openwall.com/lists/oss-security/2016/12/06/1
> (https://www.exploit-db.com/exploits/40871/)
>
> https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
> (https://www.exploit-db.com/exploits/41458/)
>
> Timers normally have their callback functions initialized either via
> the setup_timer_*() macros or manually before calls to add_timer(). The
> per-timer canary gets set in either case, and then checked at timer
> expiration time before calling the function.

Har har, I missed DEFINE_TIMER() which is rather widely used. :P

I'll send a v2, though the canary may end up being a bit weaker to
deal with static initializers.

-Kees

-- 
Kees Cook
Pixel Security