linux-kernel - Re: [PATCH v3] fs/binfmt_elf: Fix memsz

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202211101934.22CACD615@keescook>
Date:   Thu, 10 Nov 2022 19:38:44 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Pedro Falcato <pedro.falcato@...il.com>
Cc:     linux-kernel@...r.kernel.org, linux-mm@...ck.org, dalias@...c.org,
        ebiederm@...ssion.com, sam@...too.org, viro@...iv.linux.org.uk
Subject: Re: [PATCH v3] fs/binfmt_elf: Fix memsz > filesz handling

On Tue, Nov 08, 2022 at 11:07:15AM +0000, Pedro Falcato wrote:
> [...]
> +		 * This tail logic is skippable if we're the last phdr, as
> +		 * nothing can map an address >= our p_vaddr, since ELF phdr
> +		 * PT_LOAD segments are required to be sorted in an increasing
> +		 * order.

I'm still looking through the patch, but I do want to call this bit out
as a problem. The kernel cannot, unfortunately, make this assumption. See:
https://lore.kernel.org/linux-fsdevel/YfOooXQ2ScpZLhmD@fractal.localdomain/

"It turns out that almost all native Linux games published by the Virtual
Programming company have this kind of weird PT_LOAD ordering including
the famous Bioshock Infinite ... Someone should probably ask Virtual
Programming, what kind of tooling they use to create such convoluted
ELF binaries."

So, even though it's in violation of the spec, these binaries exist in
the real world, and we cannot break them. :(

-- 
Kees Cook