Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1312454

Re: [PATCH v4 8/8] x86, vdso: mark vDSO read-only after init

From Andy Lutomirski <luto@amacapital.net>
Newsgroups linux.kernel
Subject Re: [PATCH v4 8/8] x86, vdso: mark vDSO read-only after init
Date 2016-01-19 20:10 +0100
Message-ID <qSJPc-3EO-15@gated-at.bofh.it> (permalink)
References <qSIT8-33H-5@gated-at.bofh.it> <qSIT9-33H-29@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Tue, Jan 19, 2016 at 10:08 AM, Kees Cook <keescook@chromium.org> wrote:
> The vDSO does not need to be writable after __init, so mark it as
> __ro_after_init. The result kills the exploit method of writing to the
> vDSO from kernel space resulting in userspace executing the modified code,
> as shown here to bypass SMEP restrictions: http://itszn.com/blog/?p=21
>
> The memory map (with added vDSO address reporting) shows the vDSO moving
> into read-only memory:

Acked-by: Andy Lutomirski <luto@kernel.org>

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v4 8/8] x86, vdso: mark vDSO read-only after init Kees Cook <keescook@chromium.org> - 2016-01-19 19:10 +0100
  Re: [PATCH v4 8/8] x86, vdso: mark vDSO read-only after init Andy Lutomirski <luto@amacapital.net> - 2016-01-19 20:10 +0100
  Re: [PATCH v4 8/8] x86, vdso: mark vDSO read-only after init "H. Peter Anvin" <hpa@zytor.com> - 2016-01-20 04:00 +0100
  Re: [PATCH v4 8/8] x86, vdso: mark vDSO read-only after init Andy Lutomirski <luto@amacapital.net> - 2016-01-20 04:00 +0100

csiph-web