linux-kernel - Re: [PATCH] tracing: do not leak kernel addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180725210717.3b807191@vmware.local.home>
Date:   Wed, 25 Jul 2018 21:07:17 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Mark Salyzyn <salyzyn@...roid.com>
Cc:     linux-kernel@...r.kernel.org,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Ingo Molnar <mingo@...hat.com>, kernel-team@...roid.com,
        stable@...r.kernel.org
Subject: Re: [PATCH] tracing: do not leak kernel addresses

On Wed, 25 Jul 2018 13:22:36 -0700
Mark Salyzyn <salyzyn@...roid.com> wrote:

> From: Nick Desaulniers <ndesaulniers@...gle.com>
> 
> Switch from 0x%lx to 0x%pK to print the kernel addresses.
> 
> Fixes: CVE-2017-0630

Wait!!!! This breaks perf and trace-cmd! They require this to be able
to print various strings in trace events. This file is root read only,
as the CVE says.

NAK for this fix. Come up with something that doesn't break perf and
trace-cmd. That will not be trivial, as the format is stored in the
ring buffer with an address, then referenced directly. It also handles
trace_printk() functions that simply point to the string format itself.

A fix would require having a pointer be the same that is referenced
inside the kernel as well as in this file. Maybe make the format string
placed in a location that doesn't leak where the rest of the kernel
exists?

-- Steve



> Signed-off-by: Mark Salyzyn <salyzyn@...roid.com>
> Cc: Nick Desaulniers <ndesaulniers@...gle.com>
> Cc: Steven Rostedt <rostedt@...dmis.org>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: <kernel-team@...roid.com>
> Cc: <stable@...r.kernel.org> # 3.18, 4.4, 4.9, 4.14
> Cc: <linux-kernel@...r.kernel.org>
> 
> ---
>  kernel/trace/trace_printk.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
> index ad1d6164e946..93698023baf1 100644
> --- a/kernel/trace/trace_printk.c
> +++ b/kernel/trace/trace_printk.c
> @@ -304,7 +304,7 @@ static int t_show(struct seq_file *m, void *v)
>  	if (!*fmt)
>  		return 0;
>  
> -	seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
> +	seq_printf(m, "0x%pK : \"", *(unsigned long *)fmt);
>  
>  	/*
>  	 * Tabs and new lines need to be converted.