Date: Tue, 3 May 2016 06:38:55 +0000 From: "Reshetova, Elena" <elena.reshetova@...el.com> To: "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, Kees Cook <keescook@...omium.org> CC: Daniel Borkmann <daniel@...earbox.net> Subject: BPF JIT spray attack - proof of concept code for modern kernel Hi, Following Kees's suggestion, I am posting here a link to the poc code that I did to show the need of further BPF JIT hardening: https://github.com/01org/jit-spray-poc-for-ksp This poc is based on the 2012 poc done by McAllister: https://github.com/kmcallister/alameda I have kept his commits untouched and only added mine on top that you can easily see what was modified. Some description of what it does and why it does work: The original 2012 poc stopped working after the address offset randomization for loading the BPF was added: http://lingrok.org/xref/linux-net-next/kernel/bpf/core.c#143 This was due to the fact that McAllister code relied on random page guessing and was assuming filter to start at the page start. This approach clearly doesn't work with new random address allocation since one would need to guess both page and offset and incorrect guess most commonly results in a full restart need for normal machine (after which filter address has changed and you don't gain any knowledge). The main changes I did was to extend the filter size to spawn longer than 1 full page (to make sure it would overrun into the next page) and then repeat the "get root payload" there in circles with enough of "nope" instructions to render it for most success. Also, when jumping to a new random page, I would try to execute the payload a number of times on the same page changing just an offset that is less than 10 (https://github.com/01org/jit-spray-poc-for-ksp/blob/master/alameda.c#L325 ) to make sure to walk through the "nopes" and invoke the payload if the page guess was correct. I have tried the poc on virtual machine with Ubuntu with 4.4 upstream kernel and it works quite well. It can still in some cases completely stall the machine that reboot is required, but it does reach its root goal in most of the cases. Also, please not that similarly as 2012 poc code, this is not a real exploit because it requires an "insecure ko" kernel module to actually make a jump, but it illustrates the need for further JIT hardening that Daniel is currently working now on. Best Regards, Elena. Content of type "text/html" skipped Download attachment "smime.p7s" of type "application/pkcs7-signature" (7586 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.