Re: usercopy: kernel memory exposure attempt detected

From	Kees Cook <keescook@chromium.org>
Newsgroups	linux.kernel
Subject	Re: usercopy: kernel memory exposure attempt detected
Date	2016-08-19 23:10 +0200
Message-ID	<s7Zd8-2kq-43@gated-at.bofh.it> (permalink)
References	<s77Z8-TF-21@gated-at.bofh.it> <s7atY-2oK-9@gated-at.bofh.it> <s7aNk-2LP-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Aug 17, 2016 at 8:14 AM, Geert Uytterhoeven
<geert@linux-m68k.org> wrote:
> Hi Kees,
>
> On Wed, Aug 17, 2016 at 4:52 PM, Kees Cook <keescook@chromium.org> wrote:
>> On Wed, Aug 17, 2016 at 5:13 AM, Geert Uytterhoeven
>> <geert@linux-m68k.org> wrote:
>>> Saw this when using NFS root on r8a7791/koelsch, using a tree based on
>>> renesas-drivers-2016-08-16-v4.8-rc2:
>>>
>>> usercopy: kernel memory exposure attempt detected from c01ff000
>>> (<kernel text>) (4096 bytes)
>>
>> Hmmm, the kernel text exposure on ARM usually means the hardened
>> usercopy patchset was applied to an ARM tree without the _etext patch:
>> http://git.kernel.org/linus/14c4a533e0996f95a0a64dfd0b6252d788cebc74
>>
>> If you _do_ have this patch already (and based on the comment below, I
>> suspect you do: usually the missing _etext makes the system entirely
>> unbootable), then we need to dig further.
>
> Yes, I do have that patch.
>
>>> Despite the BUG(), the system continues working.
>>
>> I assume exim4 got killed, though?
>
> Possibly. I don't really use email on the development boards.
> Just a debootstrapped Debian NFS root.
>
>> If you can figure out what bytes are present at c01ff000, that may
>> give us a clue.
>
> I've added a print_hex_dump(), so we'll find out when it happens again...

Any news on this? If you still have it, I'd love to see the .config
and kernel image. I've still not been able to reproduce this.

-Kees

-- 
Kees Cook
Nexus Security

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

usercopy: kernel memory exposure attempt detected Geert Uytterhoeven <geert@linux-m68k.org> - 2016-08-17 14:20 +0200
  Re: usercopy: kernel memory exposure attempt detected Kees Cook <keescook@chromium.org> - 2016-08-17 17:00 +0200
    Re: usercopy: kernel memory exposure attempt detected Geert Uytterhoeven <geert@linux-m68k.org> - 2016-08-17 17:20 +0200
      Re: usercopy: kernel memory exposure attempt detected Kees Cook <keescook@chromium.org> - 2016-08-19 23:10 +0200

csiph-web