Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758275AbcC2Wy1 (ORCPT ); Tue, 29 Mar 2016 18:54:27 -0400 Received: from mail-io0-f194.google.com ([209.85.223.194]:36476 "EHLO mail-io0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752739AbcC2WyZ (ORCPT ); Tue, 29 Mar 2016 18:54:25 -0400 MIME-Version: 1.0 In-Reply-To: <1459281207-24377-1-git-send-email-sbauer@eng.utah.edu> References: <1459281207-24377-1-git-send-email-sbauer@eng.utah.edu> Date: Tue, 29 Mar 2016 17:54:24 -0500 X-Google-Sender-Auth: ta_x949cO0W9p1IZ9BQ-D0AShwU Message-ID: Subject: Re: [PATCH v4 0/4] SROP Mitigation: Sigreturn Cookies From: Linus Torvalds To: Scott Bauer Cc: Linux Kernel Mailing List , "kernel-hardening@lists.openwall.com" , "the arch/x86 maintainers" , Andi Kleen , Andy Lutomirski , Ingo Molnar , Thomas Gleixner , wmealing@redhat.com Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1919 Lines: 43 On Tue, Mar 29, 2016 at 2:53 PM, Scott Bauer wrote: > > These patches implement the necessary changes to generate a cookie > which will be placed above signal frame upon signal delivery to userland. > The cookie is generated using a per-process random value xor'd with > the address where the cookie will be stored on the stack. Side note: wouldn't it be better to make the cookie something that doesn't make it trivial to figure out the random value in case you already have access to a signal stack? Maybe there could be a stronger variation of this that makes the cookie be something like a single md5 round (not a full md5). Something fast, and not necessarily secure, but something that needs more than one single CPU instruction to figure out. So you could do 4 32 - the random value - the low 32 bits of the address of the cookie - the low 32 bits of the return point stack and instruction pointer Yes, yes, md5 is not cryptographically secure, and making it a single iteration rather than the full four makes it even less so, but if the attacker can generate long arbitrary code, then the whole SROP is pointless to begin with, no? In contrast, with the plain xor, the SROP would be a trivial operation if you can just force it to happen within the context of a signal, so that you can just re-use the signal return stack as-is. But mixing in the returning IP and SP would make it *much* harder to use the sigreturn as an attack vector. I realize that this would likely need to be a separate and non-default extra hardening mode, because there are *definitely* applications that take signals and then update the return address (maybe single-stepping over instructions etc). But for a *lot* of applications, signal return implies changing no signal state at all, and mixing in the returning IP and SP would seem to be a fundamentally stronger cookie. No? Linus