Messages in this thread | | | Date | Tue, 29 Nov 2011 12:37:58 -0800 | Subject | Re: [rfc 3/3] prctl: Add PR_SET_MM codes to tune up mm_struct entires | From | Kees Cook <> |
| |
On Tue, Nov 29, 2011 at 12:29 PM, Cyrill Gorcunov <gorcunov@gmail.com> wrote: > On Tue, Nov 29, 2011 at 12:19:38PM -0800, Kees Cook wrote: >> On Tue, Nov 29, 2011 at 11:12:55PM +0400, Cyrill Gorcunov wrote: >> > At restore time we need a mechanism to restore those values >> > back and for this sake PR_SET_MM prctl code is introduced. >> >> arg3 needs to be significantly more carefully validated. find_vma() doesn't >> say that vm_start <= addr, only that vm_end > addr. This effectively >> bypasses all the vma checks (mmap_min_addr, max process size, etc), with >> some pretty crazy side-effects, I think. > > Yes, I know it needs some more testing, but apart from vma bounds (yup, > good point with find_vma, I'll fix) I thought about what else should be > checked? I think VMA prototype should be checked to fit "code", "data" > templates, ie code should be at least readable and execytable, but what > about data and stack and brk, should stack be executable? That is the > point where I've got a bit confused and though putting RFC out might be > a good idea to collect opinions.
In the most basic sense, it shouldn't be possible to create an mm state that can't be reached through the normal ELF loader, calls to mmap(), mprotect(), stack growth, etc. I think it might be worth examining those paths to see how they're being bounds-checked. (And note the especially scary handling of the hidden stack guard page.)
-Kees
-- Kees Cook ChromeOS Security
| |