• Thomas Garnier's avatar
    x86/mm: Enable KASLR for physical mapping memory regions · 021182e5
    Thomas Garnier authored
    Add the physical mapping in the list of randomized memory regions.
    
    The physical memory mapping holds most allocations from boot and heap
    allocators. Knowing the base address and physical memory size, an attacker
    can deduce the PDE virtual address for the vDSO memory page. This attack
    was demonstrated at CanSecWest 2016, in the following presentation:
    
      "Getting Physical: Extreme Abuse of Intel Based Paged Systems":
      https://github.com/n3k/CansecWest2016_Getting_Physical_Extreme_Abuse_of_Intel_Based_Paging_Systems/blob/master/Presentation/CanSec2016_Presentation.pdf
    
    (See second part of the presentation).
    
    The exploits used against Linux worked successfully against 4.6+ but
    fail with KASLR memory enabled:
    
      https://github.com/n3k/CansecWest2016_Getting_Physical_Extreme_Abuse_of_Intel_Based_Paging_Systems/tree/master/Demos/Linux/exploits
    
    Similar research was done at Google leading to this patch proposal.
    
    Variants exists to overwrite /proc or /sys objects ACLs leading to
    elevation of privileges. These variants were tested against 4.6+.
    
    The page offset used by the compressed kernel retains the static value
    since it is not yet randomized during this boot stage.
    Signed-off-by: default avatarThomas Garnier <thgarnie@google.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Alexander Kuleshov <kuleshovmail@gmail.com>
    Cc: Alexander Popov <alpopov@ptsecurity.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Baoquan He <bhe@redhat.com>
    Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Christian Borntraeger <borntraeger@de.ibm.com>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Dave Young <dyoung@redhat.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Jan Beulich <JBeulich@suse.com>
    Cc: Joerg Roedel <jroedel@suse.de>
    Cc: Jonathan Corbet <corbet@lwn.net>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Juergen Gross <jgross@suse.com>
    Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Lv Zheng <lv.zheng@intel.com>
    Cc: Mark Salter <msalter@redhat.com>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Matt Fleming <matt@codeblueprint.co.uk>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephen Smalley <sds@tycho.nsa.gov>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Toshi Kani <toshi.kani@hpe.com>
    Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Cc: kernel-hardening@lists.openwall.com
    Cc: linux-doc@vger.kernel.org
    Link: http://lkml.kernel.org/r/1466556426-32664-7-git-send-email-keescook@chromium.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    021182e5
head_64.S 12.8 KB