[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 06 Dec 2014 11:40:49 +0100
From: Lionel Debroux <lionel_debroux@...oo.fr>
To: oss-security@...ts.openwall.com
Subject: Re: How GNU/Linux distros deal with offset2lib attack?
Hi,
> As you know Hector Marco disclosed a new attack targeting the
> GNU/Linux mitigation defensive technology earlier this week:
As pointed out by spender, this attack is not quite new, given that
PaX/grsec has defended against it for over a decade :)
> 1, Use Grsecurity/PaX. Afaik, Gentoo and Debian Mempo has long-term
> maintenance for Grsecurity/PaX patch. But the Grsecurity/PaX is not
> part of linux kernel mainline that'd be a problem to the most
> distros. I think linux kernel upstream won't accept PaX patch only
> because of this *kind* of issue.
Indeed, mainline won't accept a ~4 MB, ~130K-line patchset providing
dozens of configuration options and touching a couple thousand files,
even though it repeatedly protects from pretty much every published
privilege escalation exploit involving kernel holes. Often, published
exploits fall afoul both MEMORY_UDEREF and other protections (KERNEXEC,
RANDSTRUCT, etc.).
Such a huge patchset might be accepted only after being split down into
many chunks. And maybe mainline doesn't want all (or even much) of that
patch in the tree, to begin with. Multiple important mainline developers
repeatedly dismiss "security circus".
The problem is... who has time, money, interest to perform the public
service work of contributing PaX/grsec to mainline (assuming mainline
wants so, again), or even having all important mainline submissions be
implemented securely before they can go in (which didn't occur for e.g.
the eBPF interpreter, it's insecure according to spender, who had made
some code to harden the older BPF interpreter) ?
That is, who to go through:
* splitting from PaX e.g. the x86_64 PCID bits made in 2013, PAGEEXEC (&
32-bit-x86-specific SEGMEXEC), KERNEXEC, MPROTECT, MEMORY_UDEREF (which
PaXTeam repeatedly points out as a strict superset of Broadwell's SMAP,
and has worked across multiple ISAs for years), MEMORY_STACKLEAK,
MEMORY_SANITIZE (which has already pinpointed bugs later fixed in
mainline), REFCOUNT (there have also been multiple refcount-based holes
on mainline), CONSTIFY_PLUGIN, USERCOPY, SIZE_OVERFLOW, why not
LATENT_ENTROPY;
* splitting from grsec e.g. RAND_THREADSTACK, KSTACKOVERFLOW,
JIT_HARDEN, RANDSTRUCT*, CHROOT* (a whole range of improvements for
making Linux's weaker chroots closer to *BSD jails), HARDEN_IPC, DENYUSB
(which predates BadUSB being published, AFAICS);
* testing the individual pieces before submission;
* submitting to mainline;
* adjusting depending on feedback;
* submitting again;
* etc. ?
That's a time-consuming process, hard for volunteer contributors to go
through. It's easy to understand why PaXTeam, spender, ephox and others
either don't go through it and focus on improving PaX/grsec, or only
submit few, small bits (e.g. minipli submitting the constification of
three structs in the IPC system for 3.17; there are several dozens of
similar chunks in PaX, totaling hundreds of lines).
Some sizable chunks were split and contributed to mainline in the past,
e.g. constification of a number of structs containing function pointers
and which have no business being rewritable. ephox spent some time on
the splitting + submission, but many arch / driver maintainers didn't
pick up the pieces in the end...
Since then, PaX replaced manual constification (~700 KB in the patch)
with a GCC plugin + manual marking of pieces that can't be const.
And the above was only for the kernel side. Without significant work on
userspace, mainly improving / fixing (which is hard for e.g. JIT
engines...) application code + integrating PaX xattr marking into the
(all too many, redundant) packaging systems, PaX/grsecurity can't be as
usable - and therefore as used - in the real world for improving actual
end user security.
The performance cost of security can be offset by using newer generation
hardware, but inconvenience due to insufficient integration turns people
away from security-enhanced software. Last time I tried, several months
ago, booting a grsec kernel on a LMDE box, in enforcing mode, failed to
bring up a X server + desktop environment, even with FLOSS drivers, due
to various bits of MPROTECT-triggering code...
Using a grsec-hardened kernel in whitelist mode (pax.softmode=1 +
protection disabling on the executables which can't cope with e.g.
MPROTECT) is clearly much more secure than running a mainline kernel,
but not as secure as running a grsec-hardened kernel in blacklist mode.
People from Gentoo, Arch and openSUSE (that I know of) have already done
part of the work integrating PaX protections into the whole distro.
Outside of packaging system integration, solutions such as paxd do the job.
But their full potential can be reaped only when a majority of users use
them, which is not about to happen, especially if PaX/grsec remains
outside of mainline...
> 2, ASLRv3? Hector Marco( the dude who disclosured offset2lib attack)
> sent a patch to the upstream:
> https://lkml.org/lkml/2014/12/4/839
>
> Even the upstream don't accept the patch, is this possible to backport
> it & maintain it for distro community?
>
> 3, RenewSSP? IMHO, this is a solution for the way of exploit like:
> http://phrack.org/archives/issues/67/13.txt
>
> It'd be workaround for another mitigation to prevent offset2lib
> attack though. But the authors of RenewSSP don't even send a patch
> to GCC community yet. At least I can't search anything about RenewSSP
> in GCC ml.
>
> It seems ASLRv3 is the best option we have? Or anything else?
For defense in depth, all of those.
In the short term, 2) whatever expands the mainline ASLR entropy well
beyond the current state. i.e. ASLRv3/PAX_ASLR (the best of the two) +
RANDKSTACK, RANDMMAP, RAND_THREADSTACK and possibly others I forgot.
In the mid-long term, simultaneously
3) various ways of improving hardening through built-in GCC and Clang
features (more sanitizers, stronger stack protections, etc.), expanded
by kernel-specific GCC and Clang plugins. PaX and grsec have been using
GCC plugins for years
1) having a number security experts paid to work on the integration of a
meaningful subset of PaX/grsec to both mainline Linux and the userspace
of most important distros.
4) intensify efforts pinpointing, fixing, replacing userspace programs
containing memory errors and other bits of insecure coding.
Who to pay extra toolchain maintainers, extra security experts ? Perhaps
the usual suspects: RedHat, SUSE, the Linux Foundation, Google, others.
Who to train application developers and end users ?
Bye,
Lionel.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
