Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1236772
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan |
| Date | 2015-09-30 23:30 +0200 |
| Message-ID | <qex6O-aB-5@gated-at.bofh.it> (permalink) |
| References | (3 earlier) <qdJD3-4SO-9@gated-at.bofh.it> <qe7Fp-5O1-29@gated-at.bofh.it> <qejQd-6nP-3@gated-at.bofh.it> <qek9B-6Kx-39@gated-at.bofh.it> <qeq5l-6MN-41@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, Sep 30, 2015 at 6:59 AM, Ingo Molnar <mingo@kernel.org> wrote:
>
> * Thomas Gleixner <tglx@linutronix.de> wrote:
>
>> On Wed, 30 Sep 2015, Ingo Molnar wrote:
>> > diff --git a/fs/proc/array.c b/fs/proc/array.c
>> > index f60f0121e331..99082730b2ac 100644
>> > --- a/fs/proc/array.c
>> > +++ b/fs/proc/array.c
>> > @@ -507,7 +507,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
>> > seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL);
>> > seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL);
>> > seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL);
>> > - seq_put_decimal_ull(m, ' ', wchan);
>> > + seq_puts(m, " 0"); /* Used to be numeric wchan - replaced by /proc/PID/wchan */
>>
>> That should get rid of all wchan usage in do_task_stat()
>
> Indeed - updated patch attached.
>
> Thanks,
>
> Ingo
>
> ================================>
> From 985037cd05b379240dd381b29c2525758c665bb0 Mon Sep 17 00:00:00 2001
> From: Ingo Molnar <mingo@kernel.org>
> Date: Wed, 30 Sep 2015 09:15:37 +0200
> Subject: [PATCH] fs/proc: Don't expose absolute kernel addresses via wchan
>
> So wchan leaks absolute kernel addresses to unprivileged
> user-space, of kernel functions that sleep:
>
> static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
> struct pid *pid, struct task_struct *task)
> {
> unsigned long wchan;
> char symname[KSYM_NAME_LEN];
>
> wchan = get_wchan(task);
>
> if (lookup_symbol_name(wchan, symname) < 0) {
> if (!ptrace_may_access(task, PTRACE_MODE_READ))
> return 0;
> seq_printf(m, "%lu", wchan);
> } else {
> seq_printf(m, "%s", symname);
> }
>
> return 0;
> }
>
> So for example it trivially leaks the KASLR offset to any local
> attacker:
>
> fomalhaut:~> printf "%016lx\n" $(cat /proc/$$/stat | cut -d' ' -f35)
> ffffffff8123b380
>
> Most real-life uses of wchan are symbolic:
>
> ps -eo pid:10,tid:10,wchan:30,comm
>
> and procps uses /proc/PID/wchan, not the absolute address in
> /proc/PID/stat:
>
> triton:~/tip> strace -f ps -eo pid:10,tid:10,wchan:30,comm 2>&1 | grep wchan | tail -1
> open("/proc/30833/wchan", O_RDONLY) = 6
>
> These days there's very little legitimate reason user-space
> would be interested in the absolute address. The absolute
> address is mostly historic: from the days when we didn't have
> kallsyms and user-space procps had to do the decoding itself via
> the System.map.
>
> So this patch sets all numeric output to 0 and keeps the
> symbolic output in /proc/PID/wchan.
>
> ( The absolute sleep address can generally still be profiled via
> perf, by tasks with sufficient privileges. )
>
> Cc: Al Viro <viro@zeniv.linux.org.uk>
> Cc: Alexander Potapenko <glider@google.com>
> Cc: Andrey Konovalov <andreyknvl@google.com>
> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
> Cc: Andy Lutomirski <luto@amacapital.net>
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Denys Vlasenko <dvlasenk@redhat.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Kostya Serebryany <kcc@google.com>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Mike Galbraith <efault@gmx.de>
> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Sasha Levin <sasha.levin@oracle.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: kasan-dev <kasan-dev@googlegroups.com>
> Cc: linux-kernel@vger.kernel.org
> Link: http://lkml.kernel.org/r/20150930071537.GA19048@gmail.com
> Signed-off-by: Ingo Molnar <mingo@kernel.org>
> ---
> fs/proc/array.c | 6 ++----
> fs/proc/base.c | 7 +------
> 2 files changed, 3 insertions(+), 10 deletions(-)
>
> diff --git a/fs/proc/array.c b/fs/proc/array.c
> index f60f0121e331..ad5ad1e376ad 100644
> --- a/fs/proc/array.c
> +++ b/fs/proc/array.c
> @@ -375,7 +375,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
> static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
> struct pid *pid, struct task_struct *task, int whole)
> {
> - unsigned long vsize, eip, esp, wchan = ~0UL;
> + unsigned long vsize, eip, esp;
> int priority, nice;
> int tty_pgrp = -1, tty_nr = 0;
> sigset_t sigign, sigcatch;
> @@ -454,8 +454,6 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
> unlock_task_sighand(task, &flags);
> }
>
> - if (permitted && (!whole || num_threads < 2))
> - wchan = get_wchan(task);
> if (!whole) {
> min_flt = task->min_flt;
> maj_flt = task->maj_flt;
> @@ -507,7 +505,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
> seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL);
> seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL);
> seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL);
> - seq_put_decimal_ull(m, ' ', wchan);
> + seq_puts(m, " 0"); /* Used to be numeric wchan - replaced by /proc/PID/wchan */
Probably should also update Documentation/filesystems/proc.txt with
something like:
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -310,7 +310,7 @@ Table 1-4: Contents of the stat files (as of 2.6.30-rc7)
blocked bitmap of blocked signals
sigign bitmap of ignored signals
sigcatch bitmap of caught signals
- wchan address where process went to sleep
+ 0 (place holder, was wchan, see /proc/PID/wchan instead)
0 (place holder)
0 (place holder)
exit_signal signal to send to parent thread on exit
> seq_put_decimal_ull(m, ' ', 0);
> seq_put_decimal_ull(m, ' ', 0);
> seq_put_decimal_ll(m, ' ', task->exit_signal);
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index b25eee4cead5..2fdbf303e3eb 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -430,13 +430,8 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
>
> wchan = get_wchan(task);
>
> - if (lookup_symbol_name(wchan, symname) < 0) {
> - if (!ptrace_may_access(task, PTRACE_MODE_READ))
> - return 0;
> - seq_printf(m, "%lu", wchan);
> - } else {
> + if (!lookup_symbol_name(wchan, symname))
> seq_printf(m, "%s", symname);
> - }
>
> return 0;
> }
Acked-by: Kees Cook <keescook@chromium.org>
-Kees
--
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 11:10 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 11:40 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 11:50 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 12:30 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 12:40 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 13:00 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 12:00 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 12:40 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-28 17:50 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 18:10 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Thomas Gleixner <tglx@linutronix.de> - 2015-09-28 18:40 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Andy Lutomirski <luto@amacapital.net> - 2015-09-29 20:20 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Andy Lutomirski <luto@amacapital.net> - 2015-09-29 20:40 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-29 20:50 +0200
[PATCH] fs/proc: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-09-30 09:20 +0200
Re: [PATCH] fs/proc: Don't expose absolute kernel addresses via wchan Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 09:40 +0200
[PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-09-30 16:00 +0200
Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 22:40 +0200
Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Kees Cook <keescook@chromium.org> - 2015-09-30 23:30 +0200
Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 23:40 +0200
[PATCH v3] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 10:00 +0200
Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-10-01 11:00 +0200
Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 11:30 +0200
Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-10-01 12:20 +0200
Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 12:40 +0200
Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-10-01 12:50 +0200
[PATCH v5] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 13:00 +0200
[PATCH v4] fs/proc, core/debug: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 11:40 +0200
[tip:core/debug] fs/proc, core/debug: Don' t expose absolute kernel addresses via wchan tip-bot for Ingo Molnar <tipbot@zytor.com> - 2015-10-01 15:00 +0200
Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 10:10 +0200
csiph-web