Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1608264

Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into KASLR VA space for randomization

From Ingo Molnar <mingo@kernel.org>
Newsgroups linux.kernel
Subject Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into KASLR VA space for randomization
Date 2017-03-24 10:30 +0100
Message-ID <totHH-7Sh-13@gated-at.bofh.it> (permalink)
References <topE5-4WE-1@gated-at.bofh.it> <tosBY-79h-13@gated-at.bofh.it> <tosVj-7gO-1@gated-at.bofh.it> <tot4Z-7ku-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

* Dave Young <dyoung@redhat.com> wrote:

> > > So I applied this kexec fix and extended the changelog to clearly show why 
> > > this fix matters in practice.
> > 
> > I thought it only impacts kexec, but Dave thought it will impact 1st kenrel 
> > either.
> 
> Yes, I think no need to mention kexec, it is a general issue.
> 
> First, the space is reserved for EFI, so kernel should not use it for kaslr. 

It's the kernel's EFI code, and we map whatever address we want (and then pass 
that to the EFI runtime), so wether it's randomized or not is the Linux kernel's 
policy decision...

So that's my question: can these memory regions include security sensitive data, 
and if yes, how can we best randomize it while kexec and other kernel and EFI 
features still work?

Preserving virtual addresses for kexec is a red herring: the randomized offset 
could be passed to the kexec-ed kernel just fine.

Thanks,

	Ingo

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into KASLR VA space for randomization Baoquan He <bhe@redhat.com> - 2017-03-24 06:10 +0100
  [tip:x86/urgent] x86/mm/KASLR: Exclude EFI region from KASLR VA  space randomization tip-bot for Baoquan He <tipbot@zytor.com> - 2017-03-24 09:20 +0100
  Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ingo Molnar <mingo@kernel.org> - 2017-03-24 09:20 +0100
    Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Baoquan He <bhe@redhat.com> - 2017-03-24 09:40 +0100
      Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Dave Young <dyoung@redhat.com> - 2017-03-24 09:50 +0100
        Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ingo Molnar <mingo@kernel.org> - 2017-03-24 10:30 +0100
          Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Borislav Petkov <bp@alien8.de> - 2017-03-24 10:40 +0100
          Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-03-24 10:40 +0100
            Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Borislav Petkov <bp@alien8.de> - 2017-03-24 10:50 +0100
              Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-03-24 11:00 +0100
            Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Borislav Petkov <bp@alien8.de> - 2017-03-24 10:50 +0100
              Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-03-24 10:50 +0100
            Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ingo Molnar <mingo@kernel.org> - 2017-03-24 11:40 +0100
              Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-03-24 11:50 +0100
                Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Ingo Molnar <mingo@kernel.org> - 2017-03-24 12:00 +0100
          Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Baoquan He <bhe@redhat.com> - 2017-03-24 13:00 +0100
    Re: [PATCH v2] x86/mm/KASLR: EFI region is mistakenly included into  KASLR VA space for randomization Dave Young <dyoung@redhat.com> - 2017-03-24 10:00 +0100

csiph-web