lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 17 Feb 2020 15:47:27 -0800 From: Kees Cook <keescook@...omium.org> To: Ilya Dryomov <idryomov@...il.com> Cc: linux-kernel@...r.kernel.org, Linus Torvalds <torvalds@...ux-foundation.org>, Petr Mladek <pmladek@...e.com>, Steven Rostedt <rostedt@...dmis.org>, Randy Dunlap <rdunlap@...radead.org>, Sergey Senozhatsky <sergey.senozhatsky@...il.com>, "Tobin C . Harding" <me@...in.cc> Subject: Re: [PATCH] vsprintf: don't obfuscate NULL and error pointers On Mon, Feb 17, 2020 at 11:28:03PM +0100, Ilya Dryomov wrote: > I don't see what security concern is addressed by obfuscating NULL > and IS_ERR() error pointers, printed with %p/%pK. Given the number > of sites where %p is used (over 10000) and the fact that NULL pointers > aren't uncommon, it probably wouldn't take long for an attacker to > find the hash that corresponds to 0. Although harder, the same goes > for most common error values, such as -1, -2, -11, -14, etc. > > The NULL part actually fixes a regression: NULL pointers weren't > obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when > dereferencing invalid pointers") which went into 5.2. I'm tacking > the IS_ERR() part on here because error pointers won't leak kernel > addresses and printing them as pointers shouldn't be any different > from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes > debugging based on existing pr_debug and friends excruciating. > > Note that the "always print 0's for %pK when kptr_restrict == 2" > behaviour which goes way back is left as is. > > Example output with the patch applied: > > ptr error-ptr NULL > %p: 0000000001f8cc5b fffffffffffffff2 0000000000000000 > %pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000 > %px: ffff888048c04020 fffffffffffffff2 0000000000000000 > %pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000 > %pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000 This seems reasonable. Though I wonder -- since the efault string is exposed now -- should this instead print all the error-ptr strings instead of the unsigned negative pointer value? -Kees > > Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers") > Signed-off-by: Ilya Dryomov <idryomov@...il.com> > --- > lib/vsprintf.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/lib/vsprintf.c b/lib/vsprintf.c > index 7c488a1ce318..f0f0522cd5a7 100644 > --- a/lib/vsprintf.c > +++ b/lib/vsprintf.c > @@ -794,6 +794,13 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr, > unsigned long hashval; > int ret; > > + /* > + * Print the real pointer value for NULL and error pointers, > + * as they are not actual addresses. > + */ > + if (IS_ERR_OR_NULL(ptr)) > + return pointer_string(buf, end, ptr, spec); > + > /* When debugging early boot use non-cryptographically secure hash. */ > if (unlikely(debug_boot_weak_hash)) { > hashval = hash_long((unsigned long)ptr, 32); > -- > 2.19.2 > -- Kees Cook
Powered by blists - more mailing lists