lkml.org 
[lkml]   [2020]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] MIPS: Prevent READ_IMPLIES_EXEC propagation
    On Tue, Jul 07, 2020 at 05:39:01PM +0800, Tiezhu Yang wrote:
    > In the MIPS architecture, we should clear the security-relevant
    > flag READ_IMPLIES_EXEC in the function SET_PERSONALITY2() of the
    > file arch/mips/include/asm/elf.h.
    >
    > Otherwise, with this flag set, PROT_READ implies PROT_EXEC for
    > mmap to make memory executable that is not safe, because this
    > condition allows an attacker to simply jump to and execute bytes
    > that are considered to be just data [1].
    >
    > In mm/mmap.c:
    > unsigned long do_mmap(struct file *file, unsigned long addr,
    > unsigned long len, unsigned long prot,
    > unsigned long flags, vm_flags_t vm_flags,
    > unsigned long pgoff, unsigned long *populate,
    > struct list_head *uf)
    > {
    > [...]
    > if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
    > if (!(file && path_noexec(&file->f_path)))
    > prot |= PROT_EXEC;
    > [...]
    > }
    >
    > By the way, x86 and ARM64 have done the similar thing.
    >
    > After commit 250c22777fe1 ("x86_64: move kernel"), in the file
    > arch/x86/kernel/process_64.c:
    > void set_personality_64bit(void)
    > {
    > [...]
    > current->personality &= ~READ_IMPLIES_EXEC;
    > }
    >
    > After commit 48f99c8ec0b2 ("arm64: Preventing READ_IMPLIES_EXEC
    > propagation"), in the file arch/arm64/include/asm/elf.h:
    > #define SET_PERSONALITY(ex) \
    > ({ \
    > clear_thread_flag(TIF_32BIT); \
    > current->personality &= ~READ_IMPLIES_EXEC; \
    > })
    >
    > [1] https://insights.sei.cmu.edu/cert/2014/02/feeling-insecure-blame-your-parent.html
    >
    > Reported-by: Juxin Gao <gaojuxin@loongson.cn>
    > Co-developed-by: Juxin Gao <gaojuxin@loongson.cn>
    > Signed-off-by: Juxin Gao <gaojuxin@loongson.cn>
    > Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

    This seems correct to me.

    Reviewed-by: Kees Cook <keescook@chromium.org>

    BTW, does MIPS also need similar changes to this series:
    https://lore.kernel.org/lkml/20200327064820.12602-1-keescook@chromium.org/

    Quoting from there "MIPS may need adjusting but the history of CPU
    features and toolchain behavior is very unclear to me."

    --
    Kees Cook

    \
     
     \ /
      Last update: 2020-07-09 01:26    [W:4.282 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site