Date: Tue, 8 Aug 2017 10:59:49 -0700 From: Kees Cook <keescook@...omium.org> To: "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com> Cc: Thomas Gleixner <tglx@...utronix.de>, John Stultz <john.stultz@...aro.org>, Stephen Boyd <sboyd@...eaurora.org>, LKML <linux-kernel@...r.kernel.org> Subject: Re: [RFC][PATCH] timer: Add function-change canary On Mon, Aug 7, 2017 at 5:33 PM, Kees Cook <keescook@...omium.org> wrote: > This introduces canaries to struct timer_list in an effort to protect the > function callback pointer from getting rewritten during stack or heap > overflow attacks. The struct timer_list has become a recent target for > security flaw exploitation because it includes the "data" argument in > the structure, along with the function callback. This provides attackers > with a ROP-like primitive for performing limited kernel function calls > without needing all the prerequisites to stage a ROP attack. > > Recent examples of exploits using struct timer_list attacks: > > http://www.openwall.com/lists/oss-security/2016/12/06/1 > (https://www.exploit-db.com/exploits/40871/) > > https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html > (https://www.exploit-db.com/exploits/41458/) > > Timers normally have their callback functions initialized either via > the setup_timer_*() macros or manually before calls to add_timer(). The > per-timer canary gets set in either case, and then checked at timer > expiration time before calling the function. Har har, I missed DEFINE_TIMER() which is rather widely used. :P I'll send a v2, though the canary may end up being a bit weaker to deal with static initializers. -Kees -- Kees Cook Pixel Security
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.