lkml.org 
[lkml]   [2017]   [Dec]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 23/60] x86/entry/64: Make cpu_entry_area.tss read-only
On Mon, Dec 04, 2017 at 03:07:29PM +0100, Thomas Gleixner wrote:
> From: Andy Lutomirski <luto@kernel.org>
>
> The TSS is a fairly juicy target for exploits, and, now that the TSS
> is in the cpu_entry_area, it's no longer protected by kASLR. Make it
> read-only on x86_64.
>
> On x86_32, it can't be RO because it's written by the CPU during task
> switches, and we use a task gate for double faults. I'd also be
> nervous about errata if we tried to make it RO even on configurations
> without double fault handling.
>
> [ tglx: AMD confirmed that there is no problem on 64bit with TSS RO. So
> it's probably safe to assume that it's a non issue, though Intel
> might have been creative in that area. Still waiting for
> confirmation. ]
>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: David Laight <David.Laight@aculab.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Link: https://lkml.kernel.org/r/7d2f65f86a46e3489ba996932554485c3d345632.1512109321.git.luto@kernel.org
>
> ---
> arch/x86/entry/entry_32.S | 4 ++--
> arch/x86/entry/entry_64.S | 8 ++++----
> arch/x86/include/asm/fixmap.h | 13 +++++++++----
> arch/x86/include/asm/processor.h | 17 ++++++++---------
> arch/x86/include/asm/switch_to.h | 4 ++--
> arch/x86/include/asm/thread_info.h | 2 +-
> arch/x86/kernel/asm-offsets.c | 5 ++---
> arch/x86/kernel/asm-offsets_32.c | 4 ++--
> arch/x86/kernel/cpu/common.c | 29 +++++++++++++++++++----------
> arch/x86/kernel/ioport.c | 2 +-
> arch/x86/kernel/process.c | 6 +++---
> arch/x86/kernel/process_32.c | 2 +-
> arch/x86/kernel/process_64.c | 2 +-
> arch/x86/kernel/traps.c | 4 ++--
> arch/x86/lib/delay.c | 4 ++--
> arch/x86/xen/enlighten_pv.c | 2 +-
> 16 files changed, 60 insertions(+), 48 deletions(-)

Reviewed-by: Borislav Petkov <bp@suse.de>

--
Regards/Gruss,
Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--

\
 
 \ /
  Last update: 2017-12-04 21:26    [W:0.722 / U:0.276 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site