Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #57252
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.debian.bugs.dist, linux.debian.kernel |
| Subject | Bug#852324: x86/mm: Found insecure W+X mapping |
| Date | 2017-03-16 02:00 +0100 |
| Message-ID | <tlrVL-7dT-1@gated-at.bofh.it> (permalink) |
| References | <tlpAB-5Hb-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Cross-posted to 2 groups.
[Multipart message — attachments visible in raw view] - view raw
On Wed, 2017-03-15 at 22:24 +0000, Ben Hutchings wrote: > Control: retitle -1 [xen] x86/mm: Found insecure W+X mapping > Control: tag -1 upstream confirmed > Control: found -1 4.9.13-1 > > I can reproduce this with a current Debian kernel on top of Xen 4.4. > It doesn't happen with the same hardware booting the kernel directly. With CONFIG_X86_PTDUMP enabled, I can see that the first 16 MiB of the low kernel mapping is mapped with W+X permissions, with a few exceptions: 0xffff880000000000-0xffff880000099000 612K USR RW x pte 0xffff880000099000-0xffff88000009a000 4K USR ro NX pte 0xffff88000009a000-0xffff88000009b000 4K USR ro x pte 0xffff88000009b000-0xffff88000009f000 16K USR RW NX pte 0xffff88000009f000-0xffff880000100000 388K USR RW PWT PCD x pte 0xffff880000100000-0xffff880000102000 8K USR RW x pte 0xffff880000102000-0xffff880001000000 15352K USR RW x pte This accounts for all the 4090 pages reported at boot. When booting without Xen, the first 512 MiB is mapped like this: 0xffff9c2e40000000-0xffff9c2e40097000 604K RW GLB NX pte 0xffff9c2e40097000-0xffff9c2e40098000 4K ro GLB NX pte 0xffff9c2e40098000-0xffff9c2e40099000 4K ro GLB x pte 0xffff9c2e40099000-0xffff9c2e40200000 1436K RW GLB NX pte 0xffff9c2e40200000-0xffff9c2e60000000 510M RW PSE GLB NX pmd (looks like Xen inhibited kASLR too...). Ben. -- Ben Hutchings The two most common things in the universe are hydrogen and stupidity.
Back to linux.debian.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#852324: x86/mm: Found insecure W+X mapping Ben Hutchings <ben@decadent.org.uk> - 2017-03-15 23:30 +0100
Bug#852324: x86/mm: Found insecure W+X mapping Ben Hutchings <ben@decadent.org.uk> - 2017-03-16 02:00 +0100
Bug#852324: x86/mm: Found insecure W+X mapping Ben Hutchings <ben@decadent.org.uk> - 2017-03-16 22:10 +0100
Bug#852324: [Xen-devel] Bug#852324: x86/mm: Found insecure W+X mapping Andrew Cooper <andrew.cooper3@citrix.com> - 2017-03-16 23:10 +0100
Bug#852324: [Xen-devel] Bug#852324: x86/mm: Found insecure W+X mapping Ben Hutchings <ben@decadent.org.uk> - 2017-03-17 01:30 +0100
Bug#852324: [Xen-devel] Bug#852324: x86/mm: Found insecure W+X mapping Boris Ostrovsky <boris.ostrovsky@oracle.com> - 2017-03-17 04:10 +0100
Bug#852324: [Xen-devel] Bug#852324: x86/mm: Found insecure W+X mapping Andrew Cooper <andrew.cooper3@citrix.com> - 2017-03-21 13:00 +0100
csiph-web