[lkml]   [2009]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Security fix for remapping of page 0 (was [PATCH] Change ZERO_SIZE_PTR to point at unmapped space)
    On Wed, 3 Jun 2009, Stephen Smalley wrote:

    > > If one remaps page 0 then the kernel checks for NULL pointers of various
    > > flavors are bypassed and this may be exploited in various creative ways
    > > to transfer data from kernel space to user space.
    > >
    > > Fix this by not allowing the remapping of page 0. Return -EINVAL if
    > > such a mapping is attempted.
    > You can already prevent unauthorized processes from mapping low memory
    > via the existing mmap_min_addr setting, configurable via
    > SECURITY_DEFAULT_MMAP_MIN_ADDR or /proc/sys/vm/mmap_min_addr. Then
    > cap_file_mmap() or selinux_file_mmap() will apply a check when a process
    > attempts to map memory below that address.

    mmap_min_addr depends on CONFIG_SECURITY which establishes various
    strangely complex "security models".

    The system needs to be secure by default.

     \ /
      Last update: 2009-06-03 17:45    [W:0.020 / U:10.056 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site