com
Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])
by mx.google.com with SMTPS id u2sor2449321lju.66.2018.03.23.10.25.18
for <linux-mm@xxxxxxxxx>
(Google Transport Security);
Fri, 23 Mar 2018 10:25:18 -0700 (PDT)
Received-SPF: pass (google.com: domain of blackzert@xxxxxxxxx designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;
Authentication-Results: mx.google.com;
dkim=pass header.i=@gmail.com header.s=20161025 header.b=OMlmcj8c;
spf=pass (google.com: domain of blackzert@xxxxxxxxx designates 209.85.220.65 as permitted sender) smtp.mailfrom=blackzert@xxxxxxxxx;
dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:subject:from:in-reply-to:date:cc
:content-transfer-encoding:message-id:references:to;
bh=+OZYzmT42h5SnWF0OczzPVpdipxT1C1TADxUtBA1ByE=;
b=OMlmcj8clO1OhtW8TlROXMtuSBQs3b4vYoHzLtsQSLQDhAzTFgSd1w0fWr8joiDzB1
BrOebu8owGbjefmKhhGLmhtadNI+jqT6C3FHwwI4hdszSJT6+AZUdctz5/GY7HnAMxEP
PzTPeHlb+xsHuDV03Di0vInH+29WPFkbJxrbmPjPx5ZrrZk1f9RpTdqr7zl1LalYD+AQ
FmwBsIVuZXGrmaAXuzjF044CHD8t4MXd7Rfw/8gAxRPJBNHMbSUKylxwpDuK7s/ONLqz
B3cDGGcmlWF/6wrgLqSuWV+FW9B/nj4/3iLdUbWuelWpSO81f12q4iTNVi/AlMZ51W3g
MTDw==
X-Google-Smtp-Source: AG47ELs5zcJhgSg9vwDza07EaDR0FQ17bw+vBwBGrJupYOX3TXXRodca/W9uPN4u58MIyJuxfBeFnQ==
X-Received: by 10.46.157.214 with SMTP id x22mr19381421ljj.135.1521825918360;
Fri, 23 Mar 2018 10:25:18 -0700 (PDT)
Received: from [192.168.1.3] (broadband-188-255-70-164.moscow.rt.ru. [188.255.70.164])
by smtp.gmail.com with ESMTPSA id d73-v6sm2302283lfl.77.2018.03.23.10.25.15
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Fri, 23 Mar 2018 10:25:17 -0700 (PDT)
Content-Type: text/plain;
charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\))
Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.
From: Ilya Smith <blackzert@xxxxxxxxx>
In-Reply-To: <20180322135729.dbfd3575819c92c0f88c5c21@xxxxxxxxxxxxxxxxxxxx>
Date: Fri, 23 Mar 2018 20:25:15 +0300
Cc: rth@xxxxxxxxxxx, ink@xxxxxxxxxxxxxxxxxxxx, mattst88@xxxxxxxxx,
vgupta@xxxxxxxxxxxx, linux@xxxxxxxxxxxxxxx, tony.luck@xxxxxxxxx,
fenghua.yu@xxxxxxxxx, jhogan@xxxxxxxxxx, ralf@xxxxxxxxxxxxxx,
jejb@xxxxxxxxxxxxxxxx, Helge Deller <deller@xxxxxx>,
benh@xxxxxxxxxxxxxxxxxxx, paulus@xxxxxxxxx, mpe@xxxxxxxxxxxxxx,
schwidefsky@xxxxxxxxxx, heiko.carstens@xxxxxxxxxx,
ysato@xxxxxxxxxxxxxxxxxxxx, dalias@xxxxxxxx, davem@xxxxxxxxxxxxx,
tglx@xxxxxxxxxxxxx, mingo@xxxxxxxxxx, hpa@xxxxxxxxx, x86@xxxxxxxxxx,
nyc@xxxxxxxxxxxxxx, viro@xxxxxxxxxxxxxxxxxx, arnd@xxxxxxxx,
gregkh@xxxxxxxxxxxxxxxxxxx, deepa.kernel@xxxxxxxxx, mhocko@xxxxxxxx,
hughd@xxxxxxxxxx, kstewart@xxxxxxxxxxxxxxxxxxx, pombredanne@xxxxxxxx,
steve.capper@xxxxxxx, punit.agrawal@xxxxxxx, paul.burton@xxxxxxxx,
aneesh.kumar@xxxxxxxxxxxxxxxxxx, npiggin@xxxxxxxxx,
keescook@xxxxxxxxxxxx, bhsharma@xxxxxxxxxx, riel@xxxxxxxxxx,
nitin.m.gupta@xxxxxxxxxx, kirill.shutemov@xxxxxxxxxxxxxxx,
dan.j.williams@xxxxxxxxx, jack@xxxxxxx, ross.zwisler@xxxxxxxxxxxxxxx,
jglisse@xxxxxxxxxx, willy@xxxxxxxxxxxxx, aarcange@xxxxxxxxxx,
oleg@xxxxxxxxxx, linux-alpha@xxxxxxxxxxxxxxx,
linux-kernel@xxxxxxxxxxxxxxx, linux-snps-arc@xxxxxxxxxxxxxxxxxxx,
linux-arm-kernel@xxxxxxxxxxxxxxxxxxx, linux-ia64@xxxxxxxxxxxxxxx,
linux-metag@xxxxxxxxxxxxxxx, linux-mips@xxxxxxxxxxxxxx,
linux-parisc@xxxxxxxxxxxxxxx, linuxppc-dev@xxxxxxxxxxxxxxxx,
linux-s390@xxxxxxxxxxxxxxx, linux-sh@xxxxxxxxxxxxxxx,
sparclinux@xxxxxxxxxxxxxxx, linux-mm@xxxxxxxxx
Message-Id: <C43F853F-6B54-42DF-AEF2-64B22DAB8A1D@xxxxxxxxx>
References: <1521736598-12812-1-git-send-email-blackzert@xxxxxxxxx>
<20180322135729.dbfd3575819c92c0f88c5c21@xxxxxxxxxxxxxxxxxxxx>
To: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
X-Mailer: Apple Mail (2.3445.5.20)
X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4
Sender: owner-linux-mm@xxxxxxxxx
Precedence: bulk
X-Loop: owner-majordomo@xxxxxxxxx
List-ID: <linux-mm.kvack.org>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by spinics.net id w2NHPMO6022737
Hello, Andrew
Thanks for reading this patch.
> On 22 Mar 2018, at 23:57, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> On Thu, 22 Mar 2018 19:36:36 +0300 Ilya Smith <blackzert@xxxxxxxxx> wrote:
>
>> Current implementation doesn't randomize address returned by mmap.
>> All the entropy ends with choosing mmap_base_addr at the process
>> creation. After that mmap build very predictable layout of address
>> space. It allows to bypass ASLR in many cases.
>
> Perhaps some more effort on the problem description would help. *Are*
> people predicting layouts at present? What problems does this cause?
> How are they doing this and are there other approaches to solving the
> problem?
>
Sorry, Iâ??ve lost it in first version. In short - memory layout could be easily
repaired by single leakage. Also any Out of Bounds error may easily be
exploited according to current implementation. All because mmap choose address
just before previously allocated segment. You can read more about it here:
http://www.openwall.com/lists/oss-security/2018/02/27/5
Some test are available here https://github.com/blackzert/aslur.
To solve the problem Kernel should randomize address on any mmap so
attacker could never easily gain needed addresses.
> Mainly: what value does this patchset have to our users? This reader
> is unable to determine that from the information which you have
> provided. Full details, please.
The value of this patch is to decrease successful rate of exploitation
vulnerable applications.These could be either remote or local vectors.
