Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1353900

Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for signal cookies

Show all headers | View raw

* Scott Bauer <sbauer@eng.utah.edu> wrote:

> This patch adds a per-process secret to the task struct which
> will be used during signal delivery and during a sigreturn.
> Also, logic is added in signal.c to generate, place, extract,
> clear and verify the signal cookie.

>  	/*
> +	 * Canary value for signal frames placed on user stack.
> +	 * This helps mitigate "Signal Return oriented program"
> +	 * exploits in userland.
> +	 */
> +	unsigned long sig_cookie;

Could you please add a high level description in Documentation
that explains the attack and the way how this mitigation code
prevents that kind of attack?

Also, the first changelogs should contain more high level
description as well. For example, what does the 'verification'
of the signal cookie mean, and how does it prevent an SROP
attempt?

All of these patches seem to assume that people reading this code
know what SROP is and how we defend against it - that is not so.

Thanks,

	Ingo

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 1/3] SROP Mitigation: Architecture independent code for signal cookies Scott Bauer <sbauer@eng.utah.edu> - 2016-03-08 21:50 +0100
  Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for  signal cookies Andy Lutomirski <luto@amacapital.net> - 2016-03-08 22:00 +0100
    Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for  signal cookies Andy Lutomirski <luto@amacapital.net> - 2016-03-08 23:00 +0100
      Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for  signal cookies Scotty Bauer <sbauer@eng.utah.edu> - 2016-03-08 23:10 +0100
      Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for  signal cookies Scotty Bauer <sbauer@eng.utah.edu> - 2016-03-09 23:10 +0100
    Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for  signal cookies Scotty Bauer <sbauer@eng.utah.edu> - 2016-03-08 23:00 +0100
  Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code  for signal cookies kbuild test robot <lkp@intel.com> - 2016-03-08 22:10 +0100
  Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code  for signal cookies Ingo Molnar <mingo@kernel.org> - 2016-03-09 09:40 +0100
    Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for  signal cookies Scotty Bauer <sbauer@eng.utah.edu> - 2016-03-09 23:10 +0100
      Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code  for signal cookies Jonathan Corbet <corbet@lwn.net> - 2016-03-09 23:30 +0100
        Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code  for signal cookies Ingo Molnar <mingo@kernel.org> - 2016-03-10 10:50 +0100

csiph-web