On Mon, Jan 15, 2024 at 07:21:19PM +0100, mail@xxxxxxxxxx wrote: > Am 15.01.2024 17:52, schrieb Matthew Wilcox: > > On Mon, Jan 15, 2024 at 04:40:36PM +0000, Sam James wrote: > > > mail@xxxxxxxxxx writes: > > > > Hey, I read that ASLR is currently (since kernel >=5.18) broken for > > > > 32bit libs and reduced in effectiveness for 64bit libs... (the issue > > > > only arises if a lib is over 2MB). > > > > I confirmed this for myself but only for the 64bit case. > > > > > > > > I saw that this issue is being tracked by ubuntu > > > > (https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/1983357). > > > > If this is the wrong place and I should instead report it elsewhere I > > > > am very sorry. > > > > > > See also https://bugs.debian.org/1024149. Unfortunately, I don't > > > think the issue found its way upstream until now (thanks). > > > > > > CCing relevant maintainers (per the Debian bug). > > > > You know, my email address is all over that commit and the doofus who > > "discovered the vulnerability" didn't even have the courtesy to let > > me know. I've had several private emails about this over the last few > > days and I just don't care. Who's running 32-bit code and cares about > > security? 32-bit kernels are known-vulnerable to all kinds of security > > problems, and I think this is the least of your worries. > > > > This was intended to happen, it's not a surprise. > > Hi, > first of all I am very sorry, I didn't realize I should have contacted you > first (I'm not the one who found the bug initially), I will do it > differently in the future. I'm not annoyed *at you*. I'm annoyed at the guy who first "discovered" it. I'm annoyed at the people who are running around with their hair on fire. I'm annoyed at all the people who *didn't* contact me. > Unfortunately, my knowledge is not sufficient to judge how bad it is that > 32bit effectively has no ASLR support anymore. > > 64bit is also affected, even though there are probably more than enough > bits left there? I have since seen that both Arch and Ubuntu seem to have > "patches" in place (https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/commit/3904bcb32cc58c10232fb618bf96c1b43b0bc9d7) > in which they set the `CONFIG_ARCH_MMAP_RND_BITS=32` and > `CONFIG_ARCH_MMAP_RND_COMPAT_BITS=16`, I'm not sure if this is a good > result or if it will cause other problems. Yeah, I don't know either. Outside my scope of expertise. I received a suggestion off-list that we only do the PMD alignment on 64-bit, which seems quite reasonable to me. After all, I don't care about performance on 32-bit just as much as I don't care about security on 32-bit.
