lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 25 Jul 2022 11:35:01 -0700
From:   Mike Kravetz <mike.kravetz@...cle.com>
To:     Miaohe Lin <linmiaohe@...wei.com>
Cc:     Linux-MM <linux-mm@...ck.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Muchun Song <songmuchun@...edance.com>
Subject: Re: [bug report] mm/hugetlb: possible data leak with huge pmd sharing

On 07/25/22 17:07, Miaohe Lin wrote:
> Hi all:
>     When I investigate the mm/hugetlb code, I found there's a possible data leak issue
> with huge pmd sharing. Thank about the below scene:
> 
>     1. Process A and process B shares huge pmd page.(vm_flags: VM_MAYSHARE but !VM_SHARED)

Thanks,

I often get confused about the setting of VM_MAYSHARE and VM_SHARED.  When
you throw in the possibility of shared and anonymous, then I struggle a bit
more.  At one time did an audit to get the meaning clear in my mind, but still
struggle with the meanings.

Is it possible to have VM_MAYSHARE and !VM_SHARED on a hugetlb vma?  I only
took a quick look and could not find a way for this to happen.  But, I
could have easily missed something.

-- 
Mike Kravetz

>     2. Process A write fault a hugetlb page. As vm_flags is !VM_SHARED, a private copy of
> hugetlb page will be installed in the pagetable via hugetlb_wp.
>     3. Process A writes private data into hugetlb page.
>     4. Process B can read process A's private data since hugetlb page is shared through huge
> pmd sharing...
> 
> I think the above scene is possible. If so, huge pmd sharing for !VM_SHARED should be disabled
> to fix this issue? Or am I miss something about hugetlb huge pmd sharing?
> 
> Any response would be appreciated.
> 
> Thanks! :)

Powered by blists - more mailing lists