Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <CALCETrWaWTupSp6V=XXhvExtFdS6ewx_0A7hiGfStqpeuqZn8g@mail.gmail.com>
 <20181215212643.sfk2zwzatdfysbk3@pburton-laptop>
In-Reply-To: <20181215212643.sfk2zwzatdfysbk3@pburton-laptop>
From:   Andy Lutomirski <luto@kernel.org>
Date:   Sun, 16 Dec 2018 10:55:48 -0800
Message-ID: <CALCETrW49AdvgFrKkFaMtfaFcUDGGDykLDZoCH93utxe5pmPDQ@mail.gmail.com>
Subject: Re: Fixing MIPS delay slot emulation weakness?
To:     Paul Burton <paul.burton@mips.com>
Cc:     Andy Lutomirski <luto@kernel.org>,
        Linux MIPS Mailing List <linux-mips@linux-mips.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Paul Burton <paul.burton@imgtec.com>,
        David Daney <david.daney@cavium.com>,
        Ralf Baechle <ralf@linux-mips.org>,
        James Hogan <jhogan@kernel.org>, Rich Felker <dalias@libc.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Sun, Dec 16, 2018 at 1:22 AM Paul Burton <paul.burton@mips.com> wrote:
>
> Hi Andy,
>
> On Sat, Dec 15, 2018 at 11:19:37AM -0800, Andy Lutomirski wrote:
> > Some security researchers pointed out that writing to the delay slot
> > emulation page is a great exploit technique on MIPS.  It was
> > introduced in:
> >
> > commit 432c6bacbd0c16ec210c43da411ccc3855c4c010
> > Author: Paul Burton <paul.burton@imgtec.com>
> > Date:   Fri Jul 8 11:06:19 2016 +0100
> >
> >     MIPS: Use per-mm page to execute branch delay slot instructions
>
> Are there any further details you can share? You'd still need to
> persuade a program to both write to & jump to the page, right? We're
> talking purely about this providing writable+executable memory?

Yes, exactly.  You need a bug in order to take advantage of it.  The
RWX page at a known location just makes exploitation considerably
easier.

I should also note that, on x86 at least, emulating loads and stores
is not so bad.  The x86 vsyscall emulation code does it and has almost
fully correct fault semantics.  (I say "almost" because I didn't
bother getting the semantics exactly right for non-canonical addresses
and kernel addresses.)