[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <2236FBA76BA1254E88B949DDB74E612B41AF69D8@IRSMSX102.ger.corp.intel.com>
Date: Tue, 3 May 2016 06:38:55 +0000
From: "Reshetova, Elena" <elena.reshetova@...el.com>
To: "kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>, Kees Cook <keescook@...omium.org>
CC: Daniel Borkmann <daniel@...earbox.net>
Subject: BPF JIT spray attack - proof of concept code for modern kernel
Hi,
Following Kees's suggestion, I am posting here a link to the poc code that I
did to show the need of further BPF JIT hardening:
https://github.com/01org/jit-spray-poc-for-ksp
This poc is based on the 2012 poc done by McAllister:
https://github.com/kmcallister/alameda I have kept his commits untouched and
only added mine on top that you can easily see what was modified.
Some description of what it does and why it does work:
The original 2012 poc stopped working after the address offset randomization
for loading the BPF was added:
http://lingrok.org/xref/linux-net-next/kernel/bpf/core.c#143
This was due to the fact that McAllister code relied on random page guessing
and was assuming filter to start at the page start. This approach clearly
doesn't work with new random address allocation since one would need to
guess both page and offset and incorrect guess most commonly results in a
full restart need for normal machine (after which filter address has changed
and you don't gain any knowledge).
The main changes I did was to extend the filter size to spawn longer than 1
full page (to make sure it would overrun into the next page) and then repeat
the "get root payload" there in circles with enough of "nope" instructions
to render it for most success. Also, when jumping to a new random page, I
would try to execute the payload a number of times on the same page changing
just an offset that is less than 10
(https://github.com/01org/jit-spray-poc-for-ksp/blob/master/alameda.c#L325 )
to make sure to walk through the "nopes" and invoke the payload if the page
guess was correct.
I have tried the poc on virtual machine with Ubuntu with 4.4 upstream kernel
and it works quite well. It can still in some cases completely stall the
machine that reboot is required, but it does reach its root goal in most of
the cases.
Also, please not that similarly as 2012 poc code, this is not a real exploit
because it requires an "insecure ko" kernel module to actually make a jump,
but it illustrates the need for further JIT hardening that Daniel is
currently working now on.
Best Regards,
Elena.
Content of type "text/html" skipped
Download attachment "smime.p7s" of type "application/pkcs7-signature" (7586 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
