Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755584AbZFGK3y (ORCPT ); Sun, 7 Jun 2009 06:29:54 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755372AbZFGK3r (ORCPT ); Sun, 7 Jun 2009 06:29:47 -0400 Received: from atrey.karlin.mff.cuni.cz ([195.113.26.193]:38583 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755337AbZFGK3q (ORCPT ); Sun, 7 Jun 2009 06:29:46 -0400 Date: Sun, 7 Jun 2009 12:29:11 +0200 From: Pavel Machek To: Christoph Lameter Cc: "Larry H." , Linus Torvalds , linux-mm@kvack.org, Alan Cox , Rik van Riel , linux-kernel@vger.kernel.org, pageexec@freemail.hu Subject: Re: Security fix for remapping of page 0 (was [PATCH] Change ZERO_SIZE_PTR to point at unmapped space) Message-ID: <20090607102910.GA1592@ucw.cz> References: <20090530192829.GK6535@oblivion.subreption.com> <20090530230022.GO6535@oblivion.subreption.com> <20090531022158.GA9033@oblivion.subreption.com> <20090602203405.GC6701@oblivion.subreption.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1074 Lines: 26 Hi! > Ok. So what we need to do is stop this toying around with remapping of > page 0. The following patch contains a fix and a test program that > demonstrates the issue. > > > Subject: [Security] Do not allow remapping of page 0 via MAP_FIXED > > If one remaps page 0 then the kernel checks for NULL pointers of various > flavors are bypassed and this may be exploited in various creative ways > to transfer data from kernel space to user space. Yes, mmap() at page zero 0 makes exploits harder; and yes disabling it may be useful (but we tried that before, see Alan's comment). But that does not it mean it deserves _security_ label. Call it robustness or something.... Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/