linux-kernel - [PATCH 0/3] Reject setting system segments from userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231213163443.70490-1-brgerst@gmail.com>
Date:   Wed, 13 Dec 2023 11:34:40 -0500
From:   Brian Gerst <brgerst@...il.com>
To:     linux-kernel@...r.kernel.org, x86@...nel.org
Cc:     Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Borislav Petkov <bp@...en8.de>,
        "H . Peter Anvin" <hpa@...or.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Brian Gerst <brgerst@...il.com>
Subject: [PATCH 0/3] Reject setting system segments from userspace

Michal noted[1] that on systems that support UMIP, the instruction
decoder can be tricked into leaking the address of the TSS or LDT by
using ptrace to set the SS segment to a system segment index.  Prevent
this from happening by rejecting attempts to use a system segment in the
ptrace and sigreturn syscalls.

[1] https://lore.kernel.org/lkml/20231206004654.2986026-1-mhal@rbox.co/

Brian Gerst (3):
  x86: Move TSS and LDT to end of the GDT
  x86/ptrace: Reject system segements
  x86/sigreturn: Reject system segements

 arch/x86/include/asm/segment.h | 44 ++++++++++++++++++++++++----------
 arch/x86/kernel/ptrace.c       | 12 ++--------
 arch/x86/kernel/signal_32.c    |  4 ++++
 arch/x86/kernel/signal_64.c    |  4 ++++
 4 files changed, 42 insertions(+), 22 deletions(-)


base-commit: 3d626e0a7be7ddb635791fee18cb40631bc1d0b3
-- 
2.43.0