Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751144AbcCHVt5 (ORCPT ); Tue, 8 Mar 2016 16:49:57 -0500 Received: from mailhub.eng.utah.edu ([155.98.110.27]:33098 "EHLO mailhub.eng.utah.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750765AbcCHVtv (ORCPT ); Tue, 8 Mar 2016 16:49:51 -0500 Subject: Re: [PATCH v3 1/3] SROP Mitigation: Architecture independent code for signal cookies To: Andy Lutomirski References: <1457470075-4586-1-git-send-email-sbauer@eng.utah.edu> Cc: "linux-kernel@vger.kernel.org" , "kernel-hardening@lists.openwall.com" , X86 ML , wmealing@redhat.com, Andi Kleen , Abhiram Balasubramanian From: Scotty Bauer Message-ID: <56DF48EF.2080305@eng.utah.edu> Date: Tue, 8 Mar 2016 14:49:35 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-UCE-Score: -1.9 (-) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1515 Lines: 34 On 03/08/2016 01:58 PM, Andy Lutomirski wrote: > On Tue, Mar 8, 2016 at 12:47 PM, Scott Bauer wrote: >> This patch adds a per-process secret to the task struct which >> will be used during signal delivery and during a sigreturn. >> Also, logic is added in signal.c to generate, place, extract, >> clear and verify the signal cookie. >> > > Potentially silly question: it's been a while since I read the SROP > paper, but would the technique be effectively mitigated if sigreturn > were to zero out the whole signal frame before returning to user mode? > I don't know if I fully understand your question, but I'll respond anyway. SROP is possible because the kernel doesn't know whether or not the incoming sigreturn syscall is in response from a legitimate signal that the kernel had previously delivered and the program handled. So essentially these patches are an attempt to give the kernel a way to verify whether or not the the incoming sigreturn is a valid response or a exploit trying to hijack control of the user program. So no, zeroing out the frame wouldn't do much because if I understand your question correctly once we call sigreturn the kernel is going to hand off control to wherever the sigframe tells it to so I don't think zeroing would do much. The reason why I zero out the cookie is so if there is a stack leak bug or something along those lines an attacker couldnt leak the cookie and try and derive what the per-process kernel secret is. Hope that clarifies!