From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-it0-f72.google.com (mail-it0-f72.google.com [209.85.214.72]) by kanga.kvack.org (Postfix) with ESMTP id 36FD46B03D1 for ; Fri, 7 Jul 2017 09:50:38 -0400 (EDT) Received: by mail-it0-f72.google.com with SMTP id 188so49996816itx.9 for ; Fri, 07 Jul 2017 06:50:38 -0700 (PDT) Received: from resqmta-ch2-04v.sys.comcast.net (resqmta-ch2-04v.sys.comcast.net. [2001:558:fe21:29:69:252:207:36]) by mx.google.com with ESMTPS id d197si3442223itb.138.2017.07.07.06.50.37 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 07 Jul 2017 06:50:37 -0700 (PDT) Date: Fri, 7 Jul 2017 08:50:33 -0500 (CDT) From: Christoph Lameter Subject: Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation In-Reply-To: Message-ID: References: <20170706002718.GA102852@beast> <1499363602.26846.3.camel@redhat.com> Content-Type: text/plain; charset=US-ASCII Sender: owner-linux-mm@kvack.org List-ID: To: Kees Cook Cc: Rik van Riel , Andrew Morton , Pekka Enberg , David Rientjes , Joonsoo Kim , "Paul E. McKenney" , Ingo Molnar , Josh Triplett , Andy Lutomirski , Nicolas Pitre , Tejun Heo , Daniel Mack , Sebastian Andrzej Siewior , Sergey Senozhatsky , Helge Deller , Linux-MM , Tycho Andersen , LKML , "kernel-hardening@lists.openwall.com" On Thu, 6 Jul 2017, Kees Cook wrote: > Right. This is about blocking the escalation of attack capability. For > slab object overflow flaws, there are mainly two exploitation methods: > adjacent allocated object overwrite and adjacent freed object > overwrite (i.e. a freelist pointer overwrite). The first attack > depends heavily on which slab cache (and therefore which structures) > has been exposed by the bug. It's a very narrow and specific attack > method. The freelist attack is entirely general purpose since it > provides a reliable way to gain arbitrary write capabilities. > Protecting against that attack greatly narrows the options for an > attacker which makes attacks more expensive to create and possibly > less reliable (and reliability is crucial to successful attacks). The simplest thing here is to vary the location of the freelist pointer. That way you cannot hit the freepointer in a deterministic way The freepointer is put at offset 0 right now. But you could put it anywhere in the object. Index: linux/mm/slub.c =================================================================== --- linux.orig/mm/slub.c +++ linux/mm/slub.c @@ -3467,7 +3467,8 @@ static int calculate_sizes(struct kmem_c */ s->offset = size; size += sizeof(void *); - } + } else + s->offset = s->size / sizeof(void *) * #ifdef CONFIG_SLUB_DEBUG if (flags & SLAB_STORE_USER) -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org