On Fri, Dec 9, 2022 at 11:05 AM <jeffxu@xxxxxxxxxxxx> wrote: > From: Jeff Xu <jeffxu@xxxxxxxxxx> > > Since Linux introduced the memfd feature, memfd have always had their > execute bit set, and the memfd_create() syscall doesn't allow setting > it differently. > > However, in a secure by default system, such as ChromeOS, (where all > executables should come from the rootfs, which is protected by Verified > boot), this executable nature of memfd opens a door for NoExec bypass > and enables “confused deputy attack”. E.g, in VRP bug [1]: cros_vm > process created a memfd to share the content with an external process, > however the memfd is overwritten and used for executing arbitrary code > and root escalation. [2] lists more VRP in this kind. ... > [1] https://crbug.com/1305411 Can you make this accessible so those of us on the public lists can view this bug? If not, please remove it from future postings and adjust your description accordingly. -- paul-moore.com
