linux-kernel - Re: BUG: vdso changes expose elf mapping issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202504251546.FC8A40CB98@keescook>
Date: Fri, 25 Apr 2025 15:48:27 -0700
From: Kees Cook <kees@...nel.org>
To: Catalin Marinas <catalin.marinas@....com>
Cc: Ryan Roberts <ryan.roberts@....com>,
	Thomas Weißschuh <thomas.weissschuh@...utronix.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Linux-MM <linux-mm@...ck.org>,
	"linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>
Subject: Re: BUG: vdso changes expose elf mapping issue

On Fri, Apr 25, 2025 at 12:56:21PM -0700, Kees Cook wrote:
> For fixing the former, the below change might work (totally untested yet,
> I just wanted to reply with my thoughts as I start testing this). Pardon
> the goofy code style, I wanted a minimal diff here:
> 
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 7e2afe3220f7..9290a29ede28 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -1284,7 +1284,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
>  	mm->end_data = end_data;
>  	mm->start_stack = bprm->p;
>  
> -	if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) {
> +	{
>  		/*
>  		 * For architectures with ELF randomization, when executing
>  		 * a loader directly (i.e. no interpreter listed in ELF
> @@ -1299,7 +1299,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
>  			/* Otherwise leave a gap between .bss and brk. */
>  			mm->brk = mm->start_brk = mm->brk + PAGE_SIZE;
>  		}
> +	}
>  
> +	if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) {
>  		mm->brk = mm->start_brk = arch_randomize_brk(mm);
>  #ifdef compat_brk_randomized
>  		current->brk_randomized = 1;

Unsurprisingly, this patch was broken, but the idea appears to be
valid. This new patch works for me so far, though I haven't finished
getting Ubuntu 22.04 installed in an arm64 VM. Please let me know if
this fixes it:
https://lore.kernel.org/lkml/20250425224502.work.520-kees@kernel.org/

-- 
Kees Cook