lkml.org 
[lkml]   [2010]   [Nov]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking

    * Kyle McMartin <kyle@mcmartin.ca> wrote:

    > On Tue, Nov 16, 2010 at 11:46:03AM +0100, Marcus Meissner wrote:
    > > Target of this starter patch and follow ups is removing any kind of
    > > kernel space address information leak from the kernel.
    > >
    >
    > Er. Should probably hit /proc/modules while you're at it.

    Agreed. A few other kernel address things that should be hidden are:

    1) /proc/<PID>/stack

    Gives out kernel addresses and is a partial /proc/kallsyms table in essence. This
    got introduced recently. Useful to attackers.

    Then there's a handful of physical address leaks - those are less useful but useful
    in some situations:

    2) /proc/mtrr

    Gives some idea about the physical layout of the machine and can give information
    about the location of certain physical devices as well. Limited but nonzero utility
    to attackers.

    3) /proc/asound/cards

    Can gives out the physical address of a device. Limited but nonzero utility to
    attackers.

    4) /sys/devices/*/*/resources

    Shows physical addresses. Limited but nonzero utility to attackers.

    Plus there's some really limited fractional pieces of information - again, of
    nonzero utility to attackers:

    5) /proc/net/ptype

    Shows the sizes of a few kernel functions in networking code. Very limited but
    nonzero utility to attackers.

    6) /sys/kernel/slab/*/ctor

    Shows the sizes of a few kernel functions. Very limited but nonzero utility to
    attackers.

    7) /sys/module/*/sections/*

    For example:

    /sys/module/sunrpc/sections/__bug_table
    /sys/module/sunrpc/sections/__ex_table
    /sys/module/sunrpc/sections/__ksymtab
    /sys/module/sunrpc/sections/__ksymtab_gpl
    /sys/module/sunrpc/sections/__ksymtab_strings
    /sys/module/sunrpc/sections/__mcount_loc
    /sys/module/sunrpc/sections/__param

    Potentially useful to attackers.

    There's probably a few more i missed.

    Ingo


    \
     
     \ /
      Last update: 2010-11-18 08:51    [W:4.242 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site