linux-kernel - [PATCHv3 0/1] mmc: block: ioctl: Enhance userspace err-checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1ef05ea7f0304f56b83b12b105248e7a@hyperstone.com>
Date:   Tue, 20 Jun 2023 12:40:06 +0000
From:   Christian Loehle <CLoehle@...erstone.com>
To:     "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Ulf Hansson <ulf.hansson@...aro.org>,
        Adrian Hunter <adrian.hunter@...el.com>
CC:     Avri Altman <avri.altman@....com>
Subject: [PATCHv3 0/1]  mmc: block: ioctl: Enhance userspace err-checking

This series enhances the ioctl path so that userspace callers are
able to reliably check all error bits for their operation.

The current implementation poses the problem of error bits which
the caller cannot check, this is potentially a security issue.

If the phrase security issue has woken you up, but you haven't been using:
mmc-utils sanitize
mmc-utils erase secure-trim{1|2}
mmc-utils secure-erase
mmc-utils rpmb write-block
you can go back to sleep, sorry to bother you.
If you have, you are probably still fine, if there was no active
attacker sabotaging your eMMC, the secure operation probably
succeeded.
There is just no way to confirm that it actually has.

Examples include e.g. a flash-fail of the eMMC.
Card behavior differs here, R1 bit 19 could be set,
many cards will just shut off on flash-fail, so if you want to play
with this patch I would suggest aiming for WP_ERASE_SKIP,
although that technically doesn't need the patch, as WP groups could
be queried before and after erase.

sudo ./mmc writeprotect user set temp 0x0 $(($(blockdev --getsz /dev/mmcblk2))) /dev/mmcblk2
sudo ./mmc erase secure-erase 0 $(($(blockdev --getsz /dev/mmcblk2)-1)) /dev/mmcblk2

will yield

Executing Secure Erase from 0x00000000 to 0x0773ffff
High Capacity Erase Unit Size=524288 bytes
High Capacity Erase Timeout=600 ms
High Capacity Write Protect Group Size=2097152 bytes
RSP0: 0x00008900 # added by author, this is what the patch will add to RSP0
 Secure Erase Succeed!

even though no erase is issued.

v3:
- restored check on rpmb reads
- refactored to use __mmc_poll_for_busy directly
v2:
- removed extra flag and made it default behavior for write or R1B
- aggregate error flag in resp[0] instead of abusing resp[1]
- avoid open loop busy polling and reuse __mmc_poll_for_busy

Christian Loehle (1):
  mmc: block: ioctl: Add PROG-error aggregation

 drivers/mmc/core/block.c   | 26 +++++++++++++++-----------
 drivers/mmc/core/mmc_ops.c | 14 +++++++-------
 drivers/mmc/core/mmc_ops.h |  9 +++++++++
 3 files changed, 31 insertions(+), 18 deletions(-)

--
2.37.3
Download attachment "smime.p7s" of type "application/pkcs7-signature" (10302 bytes)