oss-security - Silently (or obliviously) partially-fixed CONFIG_STRICT

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170416202538.GA12165@grsecurity.net>
Date: Sun, 16 Apr 2017 16:25:38 -0400
From: Brad Spengler <spender@...ecurity.net>
To: oss-security@...ts.openwall.com
Subject: Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass

Hi all,

I wanted to provide some small notice of upstream kernel developers silently
or obliviously partially fixing a CONFIG_STRICT_DEVMEM bypass which explicitly has
never been possible in grsecurity in the past 15 years.  I say this because the commit
message makes no mention of this partially fixing a CONFIG_STRICT_DEVMEM bypass (and I
suppose a Secure Boot bypass, but what isn't these days?), and similarly makes no
mentions of the modifications it makes to the write side.  CONFIG_STRICT_DEVMEM exists
to prevent userland from directly modifying kernel memory, yet the kernel will happily
make slab allocations in allowed regions below 1MB.  CONFIG_STRICT_DEVMEM explicitly
allowed both reads and writes to these allocations.  As noted, the commit below doesn't
fix the mmap side.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94

Feel free to look at GRKERNSEC_KMEM code going back to 2002 in our 2.4.20
patch, or when it changed in 2003 for 2.4.21, or this explicit hunk, comment and
all, that's been around ever since CONFIG_STRICT_DEVMEM was added in 2008:

+#ifdef CONFIG_GRKERNSEC_KMEM
+       /* throw out everything else below 1MB */
+       if (pagenr <= 256)
+               return 0;
+#endif

<additional comments/details removed: b76e178e7b24f238ba0dd70104336298f493f0142056a1e5f35c27897369adc6>

While I'm here, some more VMAP_STACK fallout (DoS/potential memory corruption,
adding to the dozen or so posted earlier):
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=67b0503db9c29b04eadfeede6bebbfe5ddad94ef
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=606142af57dad981b78707234cfbd15f9f7b7125
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f190e3aec212fc8c61e202c51400afa7384d4bc
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=005145378c9ad7575a01b6ce1ba118fb427f583a
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=3b30460c5b0ed762be75a004e924ec3f8711e032
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=c919a3069c775c1c876bec55e00b2305d5125caa
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c4baad50297d84bde1a7ad45e50c73adae4a2192
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5593523f968bc86d42a035c6df47d5e0979b5ace
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=7926aff5c57b577ab0f43364ff0c59d968f6a414
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=2d6a0e9de03ee658a9adc3bfb2f0ca55dff1e478
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a7b5df84b6b4e5d599c7289526eed96541a0654
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8e9faa15469ed7c7467423db4c62aeed3ff4cae3

Thanks,
-Brad


Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.