Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 8 Aug 2017 10:59:49 -0700
From: Kees Cook <>
To: "" <>
Cc: Thomas Gleixner <>, John Stultz <>, 
	Stephen Boyd <>, LKML <>
Subject: Re: [RFC][PATCH] timer: Add function-change canary

On Mon, Aug 7, 2017 at 5:33 PM, Kees Cook <> wrote:
> This introduces canaries to struct timer_list in an effort to protect the
> function callback pointer from getting rewritten during stack or heap
> overflow attacks. The struct timer_list has become a recent target for
> security flaw exploitation because it includes the "data" argument in
> the structure, along with the function callback. This provides attackers
> with a ROP-like primitive for performing limited kernel function calls
> without needing all the prerequisites to stage a ROP attack.
> Recent examples of exploits using struct timer_list attacks:
> (
> (
> Timers normally have their callback functions initialized either via
> the setup_timer_*() macros or manually before calls to add_timer(). The
> per-timer canary gets set in either case, and then checked at timer
> expiration time before calling the function.

Har har, I missed DEFINE_TIMER() which is rather widely used. :P

I'll send a v2, though the canary may end up being a bit weaker to
deal with static initializers.


Kees Cook
Pixel Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.