Received: by 2002:a05:6a10:22f:0:0:0:0 with SMTP id 15csp1360908pxk; Thu, 10 Sep 2020 13:28:58 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxFpWXgi8vJXhAQMTtv9FdRaOzFqNYFRXgfGskl3FDmb9JI78b5XD6OYwyB+S13X1AfwGZy X-Received: by 2002:a17:906:250a:: with SMTP id i10mr10492630ejb.202.1599769737953; Thu, 10 Sep 2020 13:28:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1599769737; cv=none; d=google.com; s=arc-20160816; b=hXWFEiO7bnQhaLUnXTv28jSkeruJ4yUZsvuUWUMEIp0eCHH/mSObPuOU/W1i8zmrJa yL7KCePYefdB5Y6T2ESlcASjdhKf6rYiOEPypw3XWduQW3ViMG234WKcc+fkYGWJjnKD WapLn7QH5Vkgtn1duCXbiEFb+RAuBaLeJnx3WvdH7St27vcdKTMEuU7LES9VzBw0biXC 8MOa4XJboL6tJ3riEMRFCwbvKXF3Oof9tTL7Au3wRl7xQmTZNSHH4wRIxBBVa1TJ4RgM iaLDnx6mDhHevxXE94uvLZmlCfNGUfKQv67xjzgCZjYqeRUvSUSMeOANabevsg328to2 9/7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=AfgkhWr5TvQdUsjIexLihHefc7s9wXFiV4jpjvqj+P4=; b=aRr68SotvoVPB2ypkvpIztNp2lU6gjKIXciV8asC6vTBvQvyUP6zdgAOL/tN5lLEX/ 3gQnquEt9xyysNLcfFeyVao2cbSyzQNTgVkq8AlTdIymg0JRrhfLNnWOONztHeaMSPs4 cPszi+bNZdeLAhHfN8ft86XluF7YxTuhVSVPPrr1jMBEFwjp3Fs1eSKV4TyZcjBcJPnZ W2+CImh8DffF9HzaGrkRrjKARkB/z/OygyjgDbGGiM166g/9//vMDyv1Hd3wLzUMthol V+X8YjTa+PD9LWGSx8hE3dcQ99Z+nepcYYhZkrV6zN0XaBY5bQ1fcyjCHHGbuY9fFML7 ajhg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=IcAkD4z1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id v3si4160322edw.287.2020.09.10.13.28.35; Thu, 10 Sep 2020 13:28:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=IcAkD4z1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726812AbgIJUZy (ORCPT + 99 others); Thu, 10 Sep 2020 16:25:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726833AbgIJUWC (ORCPT ); Thu, 10 Sep 2020 16:22:02 -0400 Received: from mail-pj1-x1043.google.com (mail-pj1-x1043.google.com [IPv6:2607:f8b0:4864:20::1043]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4694C0617BA for ; Thu, 10 Sep 2020 13:21:23 -0700 (PDT) Received: by mail-pj1-x1043.google.com with SMTP id q4so575279pjh.5 for ; Thu, 10 Sep 2020 13:21:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=AfgkhWr5TvQdUsjIexLihHefc7s9wXFiV4jpjvqj+P4=; b=IcAkD4z1/2S2dWxK0asptEvpDVQMKoSNKpWAR+6zYzikYLiAPypGc6/bX5F0imPsE7 MkE0O1TZK8LaTu5qFlEQkg4K5glh23k39a6UqEbwmlwKwof7KYPT/0hXh4MNToieMUdR JYV1fCi//9FyuuJt8WiHG8zeHG9pAxzJd/fSw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=AfgkhWr5TvQdUsjIexLihHefc7s9wXFiV4jpjvqj+P4=; b=qYYw8kOd2IbW4SDkolSJCpcz8A7g/F+3EdMCNjs+q5jQshF/FHFfQT+5ooxr5mISxF W153+CsmP/hV4s0//npHMAyG6v0zr1X6gEGI05baP4AVBsryx62IGvkyy7haPFWRNM9n sAK8S0h1N3UZU2y/uc2YplNZ2JVtNZstcJVigvnRqJPGiJXObK59cgKMGuqXSPO+wqBb Dd9+098Ouwpnerc2LtX0bpWBE4Lv8AM3VUAwmejrDuLE8o2NjlCV0ELMNXl9mh2MdiFY JbExd3AViwCgsv54w7iqjuqtwvFoVPkZQakHv9Lt1L0pykDS7T5zVGwDQOXRPIpy+u9e JXWA== X-Gm-Message-State: AOAM533vZVcCzqowjKvJh7kDGKj5nD14FNGb25Ge/iI9rj6Gkw+gHjdX Q4mbDTiLuWdxVjNN23uYC7tT6w== X-Received: by 2002:a17:90a:cc0e:: with SMTP id b14mr1520840pju.166.1599769283338; Thu, 10 Sep 2020 13:21:23 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id r123sm7002776pfc.187.2020.09.10.13.21.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Sep 2020 13:21:21 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , John Wood , Matthew Wilcox , Jonathan Corbet , Alexander Viro , Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Luis Chamberlain , Iurii Zaikin , James Morris , "Serge E. Hallyn" , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [RFC PATCH 6/6] security/fbfam: Mitigate a fork brute force attack Date: Thu, 10 Sep 2020 13:21:07 -0700 Message-Id: <20200910202107.3799376-7-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200910202107.3799376-1-keescook@chromium.org> References: <20200910202107.3799376-1-keescook@chromium.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: John Wood In order to mitigate a fork brute force attack it is necessary to kill all the offending tasks. This tasks are all the ones that share the statistical data with the current task (the task that has crashed). Since the attack detection is done in the function fbfam_handle_attack() that is called every time a core dump is triggered, only is needed to kill the others tasks that share the same statistical data, not the current one as this is in the path to be killed. When the SIGKILL signal is sent to the offending tasks from the function fbfam_kill_tasks(), this one will be called again during the core dump due to the shared statistical data shows a quickly crashing rate. So, to avoid kill again the same tasks due to a recursive call of this function, it is necessary to disable the attack detection. To disable this attack detection, add a condition in the function fbfam_handle_attack() to not compute the crashing rate when the jiffies stored in the statistical data are set to zero. Signed-off-by: John Wood --- security/fbfam/fbfam.c | 76 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 71 insertions(+), 5 deletions(-) diff --git a/security/fbfam/fbfam.c b/security/fbfam/fbfam.c index 3aa669e4ea51..173a6122390f 100644 --- a/security/fbfam/fbfam.c +++ b/security/fbfam/fbfam.c @@ -4,8 +4,11 @@ #include #include #include +#include #include +#include #include +#include #include #include @@ -24,7 +27,8 @@ unsigned long sysctl_crashing_rate_threshold = 30000; * struct fbfam_stats - Fork brute force attack mitigation statistics. * @refc: Reference counter. * @faults: Number of crashes since jiffies. - * @jiffies: First fork or execve timestamp. + * @jiffies: First fork or execve timestamp. If zero, the attack detection is + * disabled. * * The purpose of this structure is to manage all the necessary information to * compute the crashing rate of an application. So, it holds a first fork or @@ -175,13 +179,69 @@ int fbfam_exit(void) } /** - * fbfam_handle_attack() - Fork brute force attack detection. + * fbfam_kill_tasks() - Kill the offending tasks + * + * When a fork brute force attack is detected it is necessary to kill all the + * offending tasks. Since this function is called from fbfam_handle_attack(), + * and so, every time a core dump is triggered, only is needed to kill the + * others tasks that share the same statistical data, not the current one as + * this is in the path to be killed. + * + * When the SIGKILL signal is sent to the offending tasks, this function will be + * called again during the core dump due to the shared statistical data shows a + * quickly crashing rate. So, to avoid kill again the same tasks due to a + * recursive call of this function, it is necessary to disable the attack + * detection setting the jiffies to zero. + * + * To improve the for_each_process loop it is possible to end it when all the + * tasks that shared the same statistics are found. + * + * Return: -EFAULT if the current task doesn't have statistical data. Zero + * otherwise. + */ +static int fbfam_kill_tasks(void) +{ + struct fbfam_stats *stats = current->fbfam_stats; + struct task_struct *p; + unsigned int to_kill, killed = 0; + + if (!stats) + return -EFAULT; + + to_kill = refcount_read(&stats->refc) - 1; + if (!to_kill) + return 0; + + /* Disable the attack detection */ + stats->jiffies = 0; + rcu_read_lock(); + + for_each_process(p) { + if (p == current || p->fbfam_stats != stats) + continue; + + do_send_sig_info(SIGKILL, SEND_SIG_PRIV, p, PIDTYPE_PID); + pr_warn("fbfam: Offending process with PID %d killed\n", + p->pid); + + killed += 1; + if (killed >= to_kill) + break; + } + + rcu_read_unlock(); + return 0; +} + +/** + * fbfam_handle_attack() - Fork brute force attack detection and mitigation. * @signal: Signal number that causes the core dump. * * The crashing rate of an application is computed in milliseconds per fault in * each crash. So, if this rate goes under a certain threshold there is a clear * signal that the application is crashing quickly. At this moment, a fork brute - * force attack is happening. + * force attack is happening. Under this scenario it is necessary to kill all + * the offending tasks in order to mitigate the attack. * * Return: -EFAULT if the current task doesn't have statistical data. Zero * otherwise. @@ -195,6 +255,10 @@ int fbfam_handle_attack(int signal) if (!stats) return -EFAULT; + /* The attack detection is disabled */ + if (!stats->jiffies) + return 0; + if (!(signal == SIGILL || signal == SIGBUS || signal == SIGKILL || signal == SIGSEGV || signal == SIGSYS)) return 0; @@ -205,9 +269,11 @@ int fbfam_handle_attack(int signal) delta_time = jiffies64_to_msecs(delta_jiffies); crashing_rate = delta_time / (u64)stats->faults; - if (crashing_rate < (u64)sysctl_crashing_rate_threshold) - pr_warn("fbfam: Fork brute force attack detected\n"); + if (crashing_rate >= (u64)sysctl_crashing_rate_threshold) + return 0; + pr_warn("fbfam: Fork brute force attack detected\n"); + fbfam_kill_tasks(); return 0; } -- 2.25.1