[lkml]   [2010]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
On 11/10/2010 12:53 AM, Ingo Molnar wrote:
> * H. Peter Anvin <> wrote:
>> We already do virtual relocation on 32 bits, and replicating that on 64 bits
>> wouldn't be hard. However, the linkage script strongly assumes congruency mod 2/4
>> MiB, and that is probably nontrivial to change. However, that still gives about 9
>> bits of entrophy to play with. The question is if that is enough, or if we'd have
>> to do more clever hacks.
> Even 1 bit of entropy would bring a visible improvement: a failed exploit attempt to
> the wrong address can crash the kernel with a 50% chance. 9 bits would be very nice.
> If an exploit can be brute-forced without crashing the kernel then only some
> significantly large bitness would help. So while 9 bits would be rather low for a
> user-space ASLR scheme [many user-space bugs can be brute-forced without crashing
> the system and raising alarms], it's very attractive for kernel ASLR.

Now, *relative* symbol addresses will typically not have any randomness
at all, which may limit the usefulness, of course.


H. Peter Anvin, Intel Open Source Technology Center
I work for Intel. I don't speak on their behalf.

 \ /
  Last update: 2010-11-11 03:55    [W:0.172 / U:4.884 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site