linux-kernel - [RFC][PATCH 0/3] mmc: block: ioctl: Enhance userspace err-checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 5 Apr 2023 11:57:15 +0000
From:   Christian Löhle <CLoehle@...erstone.com>
To:     Ulf Hansson <ulf.hansson@...aro.org>,
        Adrian Hunter <adrian.hunter@...el.com>,
        "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     Avri Altman <avri.altman@....com>
Subject: [RFC][PATCH 0/3] mmc: block: ioctl: Enhance userspace err-checking

This series enhances the ioctl path so that userspace callers are
able to reliably check all error bits for their operation.

The current implementation poses the problem of error bits which
the caller cannot check, this is potentially a security issue.

If the phrase security issue has woken you up, but you haven't been using:
mmc-utils sanitize
mmc-utils erase secure-trim{1|2}
mmc-utils secure-erase
mmc-utils rpmb write-block
you can go back to sleep, sorry to bother you.
If you have, you are probably still fine, if there was no active
attacker sabotaging your eMMC, the secure operation probably
succeeded.
There is just no way to confirm that it actually has.

Examples include e.g. a flash-fail of the eMMC.
Card behavior differs here, R1 bit 19 could be set,
many cards will just shut off on flash-fail, so if you want to play
with this patch I would suggest aiming for WP_ERASE_SKIP,
although that technically doesn't need the patch, as WP groups could
be queried before and after erase.

sudo ./mmc writeprotect user set temp 0x0 $(($(blockdev --getsz /dev/mmcblk2))) /dev/mmcblk2
sudo ./mmc erase secure-erase 0 $(($(blockdev --getsz /dev/mmcblk2)-1)) /dev/mmcblk2

will yield

Executing Secure Erase from 0x00000000 to 0x0773ffff
High Capacity Erase Unit Size=524288 bytes
High Capacity Erase Timeout=600 ms
High Capacity Write Protect Group Size=2097152 bytes
RSP0: 0x00000800 # added by author, this is what the patch will add
RSP1: 0x00008f40 # added by author, this is what the patch will add
 Secure Erase Succeed!

even though no erase is issued.

Why is it RFC?
setting BIT(31) of write_flag is of course hacky, would like your
comments on that. The post-PROG errors are only relevant for
either writes or SWITCH and ERASE, so operations without data,
it can safely be abused.
Similarly saving the errors in response[1] is also a bit hacky,
I personally like it a bit better for the userspace caller to
be able to distinguish immediate errors and X errors.
Just putting everything in response[0] would of course work, too.

1/3 and 2/3 are fine from my end.

Christian Loehle (3):
  mmc: block: ioctl: define rpmb reliable flag
  mmc: block: ioctl: do write error check for spi
  mmc: block: ioctl: Add error aggregation flag

 drivers/mmc/core/block.c       | 48 ++++++++++++++++++++++++++++++----
 include/uapi/linux/mmc/ioctl.h |  3 +++
 2 files changed, 46 insertions(+), 5 deletions(-)

-- 
2.37.3

Hyperstone GmbH | Reichenaustr. 39a  | 78467 Konstanz
Managing Director: Dr. Jan Peter Berns.
Commercial register of local courts: Freiburg HRB381782