On Fri, Jun 23, 2017 at 1:59 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs > are loaded below the mmap region. This means they can be made to collide > (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological > stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs > above the mmap region in all cases, and will now additionally avoid > programs falling back to the mmap region by enforcing MAP_FIXED for > program loads (i.e. if it would have collided with the stack, now it > will fail to load instead of falling back to the mmap region). It was pointed out by rmk that I described this inaccurately. I mix up my own visualization of the address space (above/below in /proc/$pid/maps) with actual value comparisons (above/below numerically). This paragraph should read: For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs are loaded above the mmap region. This means they can be made to collide (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs below the mmap region in all cases, and will now additionally avoid programs falling back to the mmap region by enforcing MAP_FIXED for program loads (i.e. if it would have collided with the stack, now it will fail to load instead of falling back to the mmap region). Andrew, are you able to manually adjust this commit log in -mm, or should I resend the patch with this paragraph corrected? Thanks! -Kees -- Kees Cook Pixel Security -- To unsubscribe from this list: send the line "unsubscribe linux-s390" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
