lkml.org 
[lkml]   [2013]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] signal: always clear sa_restorer on execve
On 03/11, Kees Cook wrote:
>
> When the new signal handlers are set up for a fork, the location of
> sa_restorer is not cleared, leaking a parent process's address space
> location to children. This allows for a potential bypass of the parent's
> ASLR by examining the sa_restorer value returned when calling sigaction().

I don't understand.

fork() should not change restorer/etc, and the child has the same address
space anyway. There is no any leak and the patch can't make any difference
in this case because flush_signal_handlers() is not called by fork().

> @@ -485,6 +485,9 @@ flush_signal_handlers(struct task_struct *t, int force_default)
> if (force_default || ka->sa.sa_handler != SIG_IGN)
> ka->sa.sa_handler = SIG_DFL;
> ka->sa.sa_flags = 0;
> +#ifdef __ARCH_HAS_SA_RESTORER
> + ka->sa.sa_restorer = NULL;
> +#endif

However, exec sets SIG_DFL but keeps ->sa_restorer, so probably this
patch makes sense anyway.

Oleg.



\
 
 \ /
  Last update: 2013-03-11 21:47    [W:0.147 / U:0.096 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site