kernel-hardening - Re: [RFC] x86/mm/KASLR: Remap GDTs at fixed location

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170106064531.GB28091@gmail.com>
Date: Fri, 6 Jan 2017 07:45:31 +0100
From: Ingo Molnar <mingo@...nel.org>
To: Arjan van de Ven <arjan@...ux.intel.com>
Cc: Thomas Garnier <thgarnie@...gle.com>,
	Andy Lutomirski <luto@...capital.net>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, "H . Peter Anvin" <hpa@...or.com>,
	Kees Cook <keescook@...omium.org>, Borislav Petkov <bp@...en8.de>,
	Andy Lutomirski <luto@...nel.org>, Dave Hansen <dave@...1.net>,
	Chen Yucong <slaoub@...il.com>,
	Paul Gortmaker <paul.gortmaker@...driver.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Masahiro Yamada <yamada.masahiro@...ionext.com>,
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
	Anna-Maria Gleixner <anna-maria@...utronix.de>,
	Boris Ostrovsky <boris.ostrovsky@...cle.com>,
	Rasmus Villemoes <linux@...musvillemoes.dk>,
	Michael Ellerman <mpe@...erman.id.au>,
	Juergen Gross <jgross@...e.com>,
	Richard Weinberger <richard@....at>, X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: [RFC] x86/mm/KASLR: Remap GDTs at fixed location


* Arjan van de Ven <arjan@...ux.intel.com> wrote:

> On 1/5/2017 9:54 AM, Thomas Garnier wrote:
> 
> > That's my goal too. I started by doing a RO remap and got couple problems with 
> > hibernation. I can try again for the next iteration or delay it for another 
> > patch. I also need to look at KVM GDT usage, I am not familiar with it yet.
> 
> don't we write to the GDT as part of the TLS segment stuff for glibc ?

Yes - but the idea would be to have two virtual memory aliases:

 1) A world-readable RO mapping of the GDT put into the fixmap area (randomization
    is not really required as the SGDT instruction exposes it anyway).

    This read-only GDT mapping has two advantages:

     - Because the GDT address is read-only it cannot be used by exploits as an 
       easy trampoline for 100% safe, deterministic rooting of the system from a 
       local process.

     - Even on older CPUs the SGDT instruction won't expose the absolute address 
       of critical kernel data structures.

 2) A kernel-only RW mapping in the linear kernel memory map where the original
    page is - randomized (as a natural part of kernel physical and virtual memory
    randomization) and only known and accessible to the kernel, SGDT doesn't 
    expose it even on older CPUs.

This way we IMHO have the best of both worlds.

Assuming there are no strange CPU errata surfacing if we use a RO GDT - OTOH that 
should be fairly easy to test for, and worst-case we could quirk-off the feature 
on CPUs where this cannot be done safely.

Thanks,

	Ingo

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.