linux-kernel - Re: [patch V2 19/37] rseq: Provide and use rseq_update_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <873494286n.ffs@tglx>
Date: Tue, 02 Sep 2025 17:19:44 +0200
From: Thomas Gleixner <tglx@...utronix.de>
To: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, LKML
 <linux-kernel@...r.kernel.org>
Cc: Jens Axboe <axboe@...nel.dk>, Peter Zijlstra <peterz@...radead.org>,
 "Paul E. McKenney" <paulmck@...nel.org>, Boqun Feng
 <boqun.feng@...il.com>, Paolo Bonzini <pbonzini@...hat.com>, Sean
 Christopherson <seanjc@...gle.com>, Wei Liu <wei.liu@...nel.org>, Dexuan
 Cui <decui@...rosoft.com>, x86@...nel.org, Arnd Bergmann <arnd@...db.de>,
 Heiko Carstens <hca@...ux.ibm.com>, Christian Borntraeger
 <borntraeger@...ux.ibm.com>, Sven Schnelle <svens@...ux.ibm.com>, Huacai
 Chen <chenhuacai@...nel.org>, Paul Walmsley <paul.walmsley@...ive.com>,
 Palmer Dabbelt <palmer@...belt.com>
Subject: Re: [patch V2 19/37] rseq: Provide and use rseq_update_user_cs()

On Mon, Aug 25 2025 at 15:16, Mathieu Desnoyers wrote:
> On 2025-08-23 12:39, Thomas Gleixner wrote:
>> If user space truly cares about
>> the security of the critical section descriptors, then it should set them
>> up once and map the descriptor memory read only.
>
> AFAIR, the attack pattern we are trying to tackle here is:

  ^^^^^ - so I'm not the only one who struggles to find some explanation
          for that in code, change logs etc. :)

> The attacker has write access to some memory (e.g. stack or heap) and
> uses his area to craft a custom rseq_cs descriptor. Using this home-made
> descriptor and storing to rseq->rseq_cs, it can set an abort_ip to e.g.
> glibc system(3) and easily call any library function through an aborting
> rseq critical section, thus bypassing ROP prevention mechanisms.
>
> Requiring the signature prior to the abort ip target prevents using rseq
> to bypass ROP prevention, because those ROP gadget targets don't have
> the signature.

Fair enough. Let me see how to integrate this properly along with a big
fat comment explaining what it actually does.

Thanks,

        tglx