linux-kernel - Re: [PATCH] mm/madvise: remove racy mm ownership check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHk-=wjWDchdE6sd+nwoGmybj96VFC8VOybCSrB7QOouPs+QvA@mail.gmail.com>
Date:   Tue, 8 Dec 2020 20:58:20 -0800
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Minchan Kim <minchan@...nel.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-mm <linux-mm@...ck.org>, Jann Horn <jannh@...gle.com>,
        Michal Hocko <mhocko@...e.com>,
        Shakeel Butt <shakeelb@...gle.com>,
        Suren Baghdasaryan <surenb@...gle.com>,
        Christian Brauner <christian@...uner.io>,
        David Rientjes <rientjes@...gle.com>,
        Brian Geffon <bgeffon@...gle.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Security Officers <security@...nel.org>
Subject: Re: [PATCH] mm/madvise: remove racy mm ownership check

On Tue, Dec 8, 2020 at 7:22 PM Minchan Kim <minchan@...nel.org> wrote:
>
> Jann spotted the security hole due to race of mm ownership check.
> If the task is sharing the mm_struct but goes through execve()
> before mm_access(), it could skip process_madvise_behavior_valid
> check. That makes *any advice hint* to reach into the remote process.
>
> This patch removes the mm ownership check.

Applied directly - I'm not sure Andrew has anything else pending, so
might as well short-circuit it.

              Linus