Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1733998

[PATCH 4.13 17/52] x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common

Show all headers | View raw

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <luto@kernel.org>

commit 767d035d838f4fd6b5a5bbd7a3f6d293b7f65a49 upstream.

execve used to leak FSBASE and GSBASE on AMD CPUs.  Fix it.

The security impact of this bug is small but not quite zero -- it
could weaken ASLR when a privileged task execs a less privileged
program, but only if program changed bitness across the exec, or the
child binary was highly unusual or actively malicious.  A child
program that was compromised after the exec would not have access to
the leaked base.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bpetkov@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chang Seok <chang.seok.bae@intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/process_64.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -229,10 +229,19 @@ start_thread_common(struct pt_regs *regs
 		    unsigned long new_sp,
 		    unsigned int _cs, unsigned int _ss, unsigned int _ds)
 {
+	WARN_ON_ONCE(regs != current_pt_regs());
+
+	if (static_cpu_has(X86_BUG_NULL_SEG)) {
+		/* Loading zero below won't clear the base. */
+		loadsegment(fs, __USER_DS);
+		load_gs_index(__USER_DS);
+	}
+
 	loadsegment(fs, 0);
 	loadsegment(es, _ds);
 	loadsegment(ds, _ds);
 	load_gs_index(0);
+
 	regs->ip		= new_ip;
 	regs->sp		= new_sp;
 	regs->cs		= _cs;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.13 00/52] 4.13.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 14/52] thunderbolt: Remove superfluous check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 16/52] thunderbolt: Allow clearing the key Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 30/52] xfs: fix recovery failure when log record header wraps log end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 04/52] vhost_net: correctly check tx avail during rx busy polling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 20/52] x86/mm, mm/hwpoison: Clear PRESENT bit for kernel 1:1 mappings of poison pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 35/52] xfs: evict all inodes involved with log redo item Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 21/52] ovl: fix false positive ESTALE on lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 37/52] xfs: open-code xfs_buf_item_dirty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 11/52] ip_tunnel: fix setting ttl and tos value in collect_md mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 01/52] Revert "net: use lib/percpu_counter API for fragmentation mem accounting" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 12/52] f2fs: let fill_super handle roll-forward errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 15/52] thunderbolt: Make key root-only accessible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 47/52] xfs: fix incorrect log_flushed on fsync Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 40/52] xfs: refactor buffer logging into buffer dirtying helper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 52/52] md/raid5: release/flush io in raid5_do_work() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.13 08/52] ipv6: fix typo in fib6_net_exit() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 50/52] xfs: use kmem_free to free return value of kmem_zalloc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 28/52] xfs: Add infrastructure needed for error propagation during buffer IO failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 24/52] libnvdimm, btt: check memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 38/52] xfs: remove unnecessary dirty bli format check for ordered bufs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 46/52] xfs: disable per-inode DAX flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 23/52] idr: remove WARN_ON_ONCE() when trying to replace negative ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 31/52] xfs: always verify the log tail during recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 41/52] xfs: dont log dirty ranges for ordered buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 43/52] xfs: move bmbt owner change to last step of extent swap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 48/52] xfs: dont set v3 xflags for v2 inodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 13/52] f2fs: check hot_data for roll-forward recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 33/52] xfs: handle -EFSCORRUPTED during head/tail verification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 39/52] xfs: ordered buffer log items are never formatted Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 10/52] tcp: fix a request socket leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 34/52] xfs: stop searching for free slots in an inode chunk when there are none Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 09/52] sctp: fix missing wake ups in some situations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 42/52] xfs: skip bmbt block ino validation during owner change Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 51/52] md/raid1/10: reset bio allocated from mempool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 36/52] xfs: check for race with xfs_reclaim_inode() in xfs_ifree_cluster() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 25/52] libnvdimm: fix integer overflow static analysis warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 32/52] xfs: fix log recovery corruption error due to tail overwrite Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 29/52] xfs: Properly retry failed inode items in case of error during buffer writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.13 03/52] gianfar: Fix Tx flow control deactivation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:10 +0200
  [PATCH 4.13 02/52] Revert "net: fix percpu memory leaks" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:10 +0200
  [PATCH 4.13 17/52] x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:10 +0200
  [PATCH 4.13 06/52] udp: drop head states only when all skb references are gone Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:10 +0200
  Re: [PATCH 4.13 00/52] 4.13.3-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-18 21:30 +0200
  Re: [PATCH 4.13 00/52] 4.13.3-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-18 22:20 +0200
    Re: [PATCH 4.13 00/52] 4.13.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-19 08:40 +0200

csiph-web