Re: [PATCH] Make /proc/slabinfo 0400

[Pekka Enberg <penberg@kernel.org>]

Hi Dan,

[ Thanks to you and Matt for taking the time to explain this to me. ]

On Fri, Mar 4, 2011 at 11:08 PM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> I could be mistaken on this, so feel free to correct me.  What if you
> just fill more than one slab with the object you'd like to overflow
> into, then pick an object that's guaranteed to reside in a slab filled
> with your objects.  Upon freeing that object and allocating a new
> to-be-overflowed object (that's sized so it's handled by the same slab
> cache), this new object will be guaranteed to be sitting immediately
> before one of your objects (or before the end of the slab if you're
> unlucky).  You can still win because it doesn't matter which specific
> object you overflow, only that you overflow one of them.

Right. So you fill a slab with objects A that you want to overflow
(struct shmid_kernel in the example exploit) then free one of them,
allocate object B, smash it (and the next object), and find the
smashed object A.

But doesn't that make the whole /slab/procinfo discussion moot? You
can always use brute force to allocate N objects (where N is larger
than max objects in a slab) and then just free nth object that's most
likely to land on the slab you have full control over (as explained by
Matt).

                        Pekka

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>