lkml.org 
[lkml]   [2016]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 0/4] x86, boot: KASLR memory randomization
From
Any feedback on this patch proposal?

Thanks,
Thomas

On Mon, Apr 25, 2016 at 9:39 AM, Thomas Garnier <thgarnie@google.com> wrote:
> This is PATCH v1 for KASLR memory implementation on x86_64. Minor changes
> were done based on RFC v1 comments.
>
> ***Background:
> The current implementation of KASLR randomizes only the base address of
> the kernel and its modules. Research was published showing that static
> memory can be overwitten to elevate privileges bypassing KASLR.
>
> In more details:
>
> The physical memory mapping holds most allocations from boot and heap
> allocators. Knowning the base address and physical memory size, an
> attacker can deduce the PDE virtual address for the vDSO memory page.
> This attack was demonstrated at CanSecWest 2016, in the "Getting
> Physical Extreme Abuse of Intel Based Paged Systems"
> https://goo.gl/ANpWdV (see second part of the presentation). Similar
> research was done at Google leading to this patch proposal. Variants
> exists to overwrite /proc or /sys objects ACLs leading to elevation of
> privileges. These variants were tested against 4.6+.
>
> This set of patches randomizes base address and padding of three
> major memory sections (physical memory mapping, vmalloc & vmemmap).
> It mitigates exploits relying on predictable kernel addresses. This
> feature can be enabled with the CONFIG_RANDOMIZE_MEMORY option.
>
> Padding for the memory hotplug support is managed by
> CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING. The default value is 10
> terabytes.
>
> The patches were tested on qemu & physical machines. Xen compatibility was
> also verified. Multiple reboots were used to verify entropy for each
> memory section.
>
> ***Problems that needed solving:
> - The three target memory sections are never at the same place between
> boots.
> - The physical memory mapping can use a virtual address not aligned on
> the PGD page table.
> - Have good entropy early at boot before get_random_bytes is available.
> - Add optional padding for memory hotplug compatibility.
>
> ***Parts:
> - The first part prepares for the KASLR memory randomization by
> refactoring entropy functions used by the current implementation and
> support PUD level virtual addresses for physical mapping.
> (Patches 01-02)
> - The second part implements the KASLR memory randomization for all
> sections mentioned.
> (Patch 03)
> - The third part adds support for memory hotplug by adding an option to
> define the padding used between the physical memory mapping section
> and the others.
> (Patch 04)
>
> Thanks!
>

\
 
 \ /
  Last update: 2016-04-29 19:01    [W:1.837 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site