On Tue, 2018-01-09 at 22:39 +0100, Daniel Borkmann wrote: > On 01/09/2018 07:04 PM, Alexei Starovoitov wrote: > > > > The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. > > > > A quote from goolge project zero blog: > > "At this point, it would normally be necessary to locate gadgets in > > the host kernel code that can be used to actually leak data by reading > > from an attacker-controlled location, shifting and masking the result > > appropriately and then using the result of that as offset to an > > attacker-controlled address for a load. But piecing gadgets together > > and figuring out which ones work in a speculation context seems annoying. > > So instead, we decided to use the eBPF interpreter, which is built into > > the host kernel - while there is no legitimate way to invoke it from inside > > a VM, the presence of the code in the host kernel's text section is sufficient > > to make it usable for the attack, just like with ordinary ROP gadgets." > > > > To make attacker job harder introduce BPF_JIT_ALWAYS_ON config > > option that removes interpreter from the kernel in favor of JIT-only mode. > > So far eBPF JIT is supported by: > > x64, arm64, arm32, sparc64, s390, powerpc64, mips64 > > > > The start of JITed program is randomized and code page is marked as read-only. > > In addition "constant blinding" can be turned on with net.core.bpf_jit_harden > > > > v2->v3: > > - move __bpf_prog_ret0 under ifdef (Daniel) > > > > v1->v2: > > - fix init order, test_bpf and cBPF (Daniel's feedback) > > - fix offloaded bpf (Jakub's feedback) > > - add 'return 0' dummy in case something can invoke prog->bpf_func > > - retarget bpf tree. For bpf-next the patch would need one extra hunk. > > It will be sent when the trees are merged back to net-next > > > > Considered doing: > > int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT; > > but it seems better to land the patch as-is and in bpf-next remove > > bpf_jit_enable global variable from all JITs, consolidate in one place > > and remove this jit_init() function. > > > > Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx> > > Applied to bpf tree, thanks Alexei! For stable too?
Attachment:
smime.p7s
Description: S/MIME cryptographic signature