[lkml]   [2011]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [BUG] perf: bogus correlation of kernel symbols
    On Fri, May 20, 2011 at 10:41 AM, Dan Rosenberg
    <> wrote:
    > Also, I'd still welcome suggestions on generating entropy so early in
    > the boot process as to randomize the location at which the kernel is
    > decompressed.

    The fundamental problem with the whole kernel address randomization is
    sadly totally unrelated to any of the small details.

    There's a *big* detail that makes it hard: there's only a few bits of
    randomness we can add to the address. The kernel base address ends up
    having various fundamental limitations (cacheline alignment for the
    code, and we have several segments that require page alignment), so
    you really can't realistically do more than something like 8-12 bits
    of address randomization.

    Which means that once you have a vmlinux image (say, because it's a
    standard distro kernel), you only need to try your exploit a few
    hundred times. That can be done quickly enough that no MIS person will
    ever have time to react to the attack.

    Sure, it will likely leave some hints around (oopses etc), but still..

    > On a related note, would there be obstacles to marking the IDT as
    > read-only?

    We do that for the F00F bug workaround. But while the linear address
    is read-only, the IDT can still be accessed read-write through the
    physical address through the normal 1:1 mapping.

    Regardless, the virtual mapping trick (independently of whether it's
    read-only or not) can be used to avoid exposing the *actual* address
    of the IDT of the kernel, and would hide the kernel load address
    details. However, it does make traps slightly slower, if they cannot
    use the 1:1 mapping with large pages for the IDT access and thus cause
    more TLB pressure. Of course, in many situations we probably end up
    not having large pages for the kernel anyway, so..

    As a result, we do that F00F bug workaround _only_ if we're actually
    running on a CPU with the FOOF bug.


     \ /
      Last update: 2011-05-20 20:17    [W:0.024 / U:0.892 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site