Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758112AbcC2VhG (ORCPT ); Tue, 29 Mar 2016 17:37:06 -0400 Received: from mailhub.eng.utah.edu ([155.98.110.27]:54852 "EHLO mailhub.eng.utah.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754508AbcC2VhF (ORCPT ); Tue, 29 Mar 2016 17:37:05 -0400 Subject: Re: [PATCH v4 0/4] SROP Mitigation: Sigreturn Cookies To: Andy Lutomirski References: <1459281207-24377-1-git-send-email-sbauer@eng.utah.edu> Cc: "linux-kernel@vger.kernel.org" , "kernel-hardening@lists.openwall.com" , X86 ML , Andi Kleen , Ingo Molnar , Thomas Gleixner , wmealing@redhat.com, Linus Torvalds From: Scotty Bauer Message-ID: <56FAF571.3040802@eng.utah.edu> Date: Tue, 29 Mar 2016 15:36:49 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-UCE-Score: -1.9 (-) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2001 Lines: 43 On 03/29/2016 03:29 PM, Andy Lutomirski wrote: > On Tue, Mar 29, 2016 at 12:53 PM, Scott Bauer wrote: >> Sigreturn-oriented programming is a new attack vector in userland >> where an attacker crafts a fake signal frame on the stack and calls >> sigreturn. The kernel will extract the fake signal frame, which >> contains attacker controlled "saved" registers. The kernel will then >> transfer control to the attacker controlled userland instruction pointer. >> >> To prevent SROP attacks the kernel needs to know or be able to dervive >> whether a sigreturn it is processing is in response to a legitimate >> signal the kernel previously delivered. >> >> Further information and test code can be found in Documentation/security >> and this excellent article: >> http://lwn.net/Articles/676803/ >> >> These patches implement the necessary changes to generate a cookie >> which will be placed above signal frame upon signal delivery to userland. >> The cookie is generated using a per-process random value xor'd with >> the address where the cookie will be stored on the stack. >> >> Upon a sigreturn the kernel will extract the cookie from userland, >> recalculate what the original cookie should be and verify that the two >> do not differ. If the two differ the kernel will terminate the process >> with a SIGSEGV. >> >> This prevents SROP by adding a value that the attacker cannot guess, >> but the kernel can verify. Therefore an attacker cannot use sigreturn as >> a method to control the flow of a process. >> > > Has anyone verified that this doesn't break CRIU cross-machine (or > cross-boot) migration and that this doesn't break dosemu? You're > changing the ABI here. > I haven't yet I'll do that to verify it breaks -- I'm pretty sure under some conditions it will break CRIU. That's why we added the sysctl to turn it off. Should I have mentioned this in the main commit that it possibly breaks CRIU/DOSEMU? I went ahead and added that to the Documentation.