• Jann Horn's avatar
    proc: restrict kernel stack dumps to root · f8a00cef
    Jann Horn authored
    Currently, you can use /proc/self/task/*/stack to cause a stack walk on
    a task you control while it is running on another CPU.  That means that
    the stack can change under the stack walker.  The stack walker does
    have guards against going completely off the rails and into random
    kernel memory, but it can interpret random data from your kernel stack
    as instruction pointers and stack pointers.  This can cause exposure of
    kernel stack contents to userspace.
    
    Restrict the ability to inspect kernel stacks of arbitrary tasks to root
    in order to prevent a local attacker from exploiting racy stack unwinding
    to leak kernel task stack contents.  See the added comment for a longer
    rationale.
    
    There don't seem to be any users of this userspace API that can't
    gracefully bail out if reading from the file fails.  Therefore, I believe
    that this change is unlikely to break things.  In the case that this patch
    does end up needing a revert, the next-best solution might be to fake a
    single-entry stack based on wchan.
    
    Link: http://lkml.kernel.org/r/20180927153316.200286-1-jannh@google.com
    Fixes: 2ec220e2 ("proc: add /proc/*/stack")
    Signed-off-by: default avatarJann Horn <jannh@google.com>
    Acked-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Cc: Ken Chen <kenchen@google.com>
    Cc: Will Deacon <will.deacon@arm.com>
    Cc: Laura Abbott <labbott@redhat.com>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: "H . Peter Anvin" <hpa@zytor.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    f8a00cef
base.c 86.1 KB