diff mbox

arm64: vdso: Mark vDSO code as read-only

Message ID 1455141142-6838-1-git-send-email-david.brown@linaro.org
State Accepted
Commit 88d8a7994e564d209d4b2583496631c2357d386b
Headers show

Commit Message

David Brown Feb. 10, 2016, 9:52 p.m. UTC
Although the arm64 vDSO is cleanly separated by code/data with the
code being read-only in userspace mappings, the code page is still
writable from the kernel.  There have been exploits (such as
http://itszn.com/blog/?p=21) that take advantage of this on x86 to go
from a bad kernel write to full root.

Prevent this specific exploit on arm64 by putting the vDSO code page
in read-only memory as well.

Before the change:
[    3.138366] vdso: 2 pages (1 code @ ffffffc000a71000, 1 data @ ffffffc000a70000)
---[ Kernel Mapping ]---
0xffffffc000000000-0xffffffc000082000         520K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc000082000-0xffffffc000200000        1528K     ro x  SHD AF            UXN MEM/NORMAL
0xffffffc000200000-0xffffffc000800000           6M     ro x  SHD AF        BLK UXN MEM/NORMAL
0xffffffc000800000-0xffffffc0009b6000        1752K     ro x  SHD AF            UXN MEM/NORMAL
0xffffffc0009b6000-0xffffffc000c00000        2344K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc000c00000-0xffffffc008000000         116M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc00c000000-0xffffffc07f000000        1840M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc800000000-0xffffffc840000000           1G     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc840000000-0xffffffc87ae00000         942M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc87ae00000-0xffffffc87ae70000         448K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87af80000-0xffffffc87af8a000          40K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87af8b000-0xffffffc87b000000         468K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87b000000-0xffffffc87fe00000          78M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc87fe00000-0xffffffc87ff50000        1344K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87ff90000-0xffffffc87ffa0000          64K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87fff0000-0xffffffc880000000          64K     RW NX SHD AF            UXN MEM/NORMAL

After:
[    3.138368] vdso: 2 pages (1 code @ ffffffc0006de000, 1 data @ ffffffc000a74000)
---[ Kernel Mapping ]---
0xffffffc000000000-0xffffffc000082000         520K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc000082000-0xffffffc000200000        1528K     ro x  SHD AF            UXN MEM/NORMAL
0xffffffc000200000-0xffffffc000800000           6M     ro x  SHD AF        BLK UXN MEM/NORMAL
0xffffffc000800000-0xffffffc0009b8000        1760K     ro x  SHD AF            UXN MEM/NORMAL
0xffffffc0009b8000-0xffffffc000c00000        2336K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc000c00000-0xffffffc008000000         116M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc00c000000-0xffffffc07f000000        1840M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc800000000-0xffffffc840000000           1G     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc840000000-0xffffffc87ae00000         942M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc87ae00000-0xffffffc87ae70000         448K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87af80000-0xffffffc87af8a000          40K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87af8b000-0xffffffc87b000000         468K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87b000000-0xffffffc87fe00000          78M     RW NX SHD AF        BLK UXN MEM/NORMAL
0xffffffc87fe00000-0xffffffc87ff50000        1344K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87ff90000-0xffffffc87ffa0000          64K     RW NX SHD AF            UXN MEM/NORMAL
0xffffffc87fff0000-0xffffffc880000000          64K     RW NX SHD AF            UXN MEM/NORMAL

Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the
PaX Team, Brad Spengler, and Kees Cook.

Signed-off-by: David Brown <david.brown@linaro.org>

---
 arch/arm64/kernel/vdso/vdso.S | 1 +
 1 file changed, 1 insertion(+)

-- 
2.7.1

Comments

Will Deacon Feb. 11, 2016, 1:47 p.m. UTC | #1
On Wed, Feb 10, 2016 at 01:52:22PM -0800, David Brown wrote:
> Although the arm64 vDSO is cleanly separated by code/data with the

> code being read-only in userspace mappings, the code page is still

> writable from the kernel.  There have been exploits (such as

> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go

> from a bad kernel write to full root.

> 

> Prevent this specific exploit on arm64 by putting the vDSO code page

> in read-only memory as well.

> 

> Before the change:

> [    3.138366] vdso: 2 pages (1 code @ ffffffc000a71000, 1 data @ ffffffc000a70000)

> ---[ Kernel Mapping ]---

> 0xffffffc000000000-0xffffffc000082000         520K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000082000-0xffffffc000200000        1528K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc000200000-0xffffffc000800000           6M     ro x  SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc000800000-0xffffffc0009b6000        1752K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc0009b6000-0xffffffc000c00000        2344K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000c00000-0xffffffc008000000         116M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc00c000000-0xffffffc07f000000        1840M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc800000000-0xffffffc840000000           1G     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc840000000-0xffffffc87ae00000         942M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87ae00000-0xffffffc87ae70000         448K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af80000-0xffffffc87af8a000          40K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af8b000-0xffffffc87b000000         468K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87b000000-0xffffffc87fe00000          78M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87fe00000-0xffffffc87ff50000        1344K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87ff90000-0xffffffc87ffa0000          64K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87fff0000-0xffffffc880000000          64K     RW NX SHD AF            UXN MEM/NORMAL

> 

> After:

> [    3.138368] vdso: 2 pages (1 code @ ffffffc0006de000, 1 data @ ffffffc000a74000)

> ---[ Kernel Mapping ]---

> 0xffffffc000000000-0xffffffc000082000         520K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000082000-0xffffffc000200000        1528K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc000200000-0xffffffc000800000           6M     ro x  SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc000800000-0xffffffc0009b8000        1760K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc0009b8000-0xffffffc000c00000        2336K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000c00000-0xffffffc008000000         116M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc00c000000-0xffffffc07f000000        1840M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc800000000-0xffffffc840000000           1G     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc840000000-0xffffffc87ae00000         942M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87ae00000-0xffffffc87ae70000         448K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af80000-0xffffffc87af8a000          40K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af8b000-0xffffffc87b000000         468K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87b000000-0xffffffc87fe00000          78M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87fe00000-0xffffffc87ff50000        1344K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87ff90000-0xffffffc87ffa0000          64K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87fff0000-0xffffffc880000000          64K     RW NX SHD AF            UXN MEM/NORMAL

> 

> Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the

> PaX Team, Brad Spengler, and Kees Cook.

> 

> Signed-off-by: David Brown <david.brown@linaro.org>

> ---

>  arch/arm64/kernel/vdso/vdso.S | 1 +

>  1 file changed, 1 insertion(+)

> 

> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S

> index 60c1db5..db7c0f2 100644

> --- a/arch/arm64/kernel/vdso/vdso.S

> +++ b/arch/arm64/kernel/vdso/vdso.S

> @@ -24,6 +24,7 @@

>  	__PAGE_ALIGNED_DATA

>  

>  	.globl vdso_start, vdso_end

> +	.section .rodata

>  	.balign PAGE_SIZE

>  vdso_start:

>  	.incbin "arch/arm64/kernel/vdso/vdso.so"


Nice, I wish I'd thought of that!

Acked-by: Will Deacon <will.deacon@arm.com>


As an aside, I wonder whether we should be printing the code/data
addresses out in dmesg at all.

Will
Ard Biesheuvel Feb. 11, 2016, 2:19 p.m. UTC | #2
Hi David,

Nice find!

On 10 February 2016 at 22:52, David Brown <david.brown@linaro.org> wrote:
> Although the arm64 vDSO is cleanly separated by code/data with the

> code being read-only in userspace mappings, the code page is still

> writable from the kernel.  There have been exploits (such as

> http://itszn.com/blog/?p=21) that take advantage of this on x86 to go

> from a bad kernel write to full root.

>

> Prevent this specific exploit on arm64 by putting the vDSO code page

> in read-only memory as well.

>

> Before the change:

> [    3.138366] vdso: 2 pages (1 code @ ffffffc000a71000, 1 data @ ffffffc000a70000)

> ---[ Kernel Mapping ]---

> 0xffffffc000000000-0xffffffc000082000         520K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000082000-0xffffffc000200000        1528K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc000200000-0xffffffc000800000           6M     ro x  SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc000800000-0xffffffc0009b6000        1752K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc0009b6000-0xffffffc000c00000        2344K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000c00000-0xffffffc008000000         116M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc00c000000-0xffffffc07f000000        1840M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc800000000-0xffffffc840000000           1G     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc840000000-0xffffffc87ae00000         942M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87ae00000-0xffffffc87ae70000         448K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af80000-0xffffffc87af8a000          40K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af8b000-0xffffffc87b000000         468K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87b000000-0xffffffc87fe00000          78M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87fe00000-0xffffffc87ff50000        1344K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87ff90000-0xffffffc87ffa0000          64K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87fff0000-0xffffffc880000000          64K     RW NX SHD AF            UXN MEM/NORMAL

>

> After:

> [    3.138368] vdso: 2 pages (1 code @ ffffffc0006de000, 1 data @ ffffffc000a74000)

> ---[ Kernel Mapping ]---

> 0xffffffc000000000-0xffffffc000082000         520K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000082000-0xffffffc000200000        1528K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc000200000-0xffffffc000800000           6M     ro x  SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc000800000-0xffffffc0009b8000        1760K     ro x  SHD AF            UXN MEM/NORMAL

> 0xffffffc0009b8000-0xffffffc000c00000        2336K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc000c00000-0xffffffc008000000         116M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc00c000000-0xffffffc07f000000        1840M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc800000000-0xffffffc840000000           1G     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc840000000-0xffffffc87ae00000         942M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87ae00000-0xffffffc87ae70000         448K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af80000-0xffffffc87af8a000          40K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87af8b000-0xffffffc87b000000         468K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87b000000-0xffffffc87fe00000          78M     RW NX SHD AF        BLK UXN MEM/NORMAL

> 0xffffffc87fe00000-0xffffffc87ff50000        1344K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87ff90000-0xffffffc87ffa0000          64K     RW NX SHD AF            UXN MEM/NORMAL

> 0xffffffc87fff0000-0xffffffc880000000          64K     RW NX SHD AF            UXN MEM/NORMAL

>

> Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the

> PaX Team, Brad Spengler, and Kees Cook.

>

> Signed-off-by: David Brown <david.brown@linaro.org>

> ---

>  arch/arm64/kernel/vdso/vdso.S | 1 +

>  1 file changed, 1 insertion(+)

>

> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S

> index 60c1db5..db7c0f2 100644

> --- a/arch/arm64/kernel/vdso/vdso.S

> +++ b/arch/arm64/kernel/vdso/vdso.S

> @@ -24,6 +24,7 @@

>         __PAGE_ALIGNED_DATA


^^ You can get rid of this now as well

Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>


>

>         .globl vdso_start, vdso_end

> +       .section .rodata

>         .balign PAGE_SIZE

>  vdso_start:

>         .incbin "arch/arm64/kernel/vdso/vdso.so"

> --

> 2.7.1

>
David Brown Feb. 13, 2016, 12:31 a.m. UTC | #3
On Thu, Feb 11, 2016 at 03:19:20PM +0100, Ard Biesheuvel wrote:

>> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S

>> index 60c1db5..db7c0f2 100644

>> --- a/arch/arm64/kernel/vdso/vdso.S

>> +++ b/arch/arm64/kernel/vdso/vdso.S

>> @@ -24,6 +24,7 @@

>>         __PAGE_ALIGNED_DATA

>

>^^ You can get rid of this now as well


Can we?  The page is getting mapped to userspace, and if we didn't
page align it, we could leak kernel read-only data to every userspace
process.

David
Ard Biesheuvel Feb. 13, 2016, 9 a.m. UTC | #4
On 13 February 2016 at 01:31, David Brown <david.brown@linaro.org> wrote:
> On Thu, Feb 11, 2016 at 03:19:20PM +0100, Ard Biesheuvel wrote:

>

>>> diff --git a/arch/arm64/kernel/vdso/vdso.S

>>> b/arch/arm64/kernel/vdso/vdso.S

>>> index 60c1db5..db7c0f2 100644

>>> --- a/arch/arm64/kernel/vdso/vdso.S

>>> +++ b/arch/arm64/kernel/vdso/vdso.S

>>> @@ -24,6 +24,7 @@

>>>         __PAGE_ALIGNED_DATA

>>

>>

>> ^^ You can get rid of this now as well

>

>

> Can we?  The page is getting mapped to userspace, and if we didn't

> page align it, we could leak kernel read-only data to every userspace

> process.

>


That's what the .balign is for. __PAGE_ALIGNED_DATA only sets the
section, and you're overriding that right after.
Catalin Marinas Feb. 16, 2016, 6:22 p.m. UTC | #5
On Wed, Feb 10, 2016 at 01:52:22PM -0800, David Brown wrote:
> diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S

> index 60c1db5..db7c0f2 100644

> --- a/arch/arm64/kernel/vdso/vdso.S

> +++ b/arch/arm64/kernel/vdso/vdso.S

> @@ -24,6 +24,7 @@

>  	__PAGE_ALIGNED_DATA

>  

>  	.globl vdso_start, vdso_end

> +	.section .rodata

>  	.balign PAGE_SIZE

>  vdso_start:

>  	.incbin "arch/arm64/kernel/vdso/vdso.so"

> -- 

> 2.7.1


Patch applied (and removed __PAGE_ALIGNED_DATA as well). Thanks.

-- 
Catalin
diff mbox

Patch

diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S
index 60c1db5..db7c0f2 100644
--- a/arch/arm64/kernel/vdso/vdso.S
+++ b/arch/arm64/kernel/vdso/vdso.S
@@ -24,6 +24,7 @@ 
 	__PAGE_ALIGNED_DATA
 
 	.globl vdso_start, vdso_end
+	.section .rodata
 	.balign PAGE_SIZE
 vdso_start:
 	.incbin "arch/arm64/kernel/vdso/vdso.so"