lkml.org 
[lkml]   [2013]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] signal: always clear sa_restorer on execve
    When the new signal handlers are set up for a fork, the location of
    sa_restorer is not cleared, leaking a parent process's address space
    location to children. This allows for a potential bypass of the parent's
    ASLR by examining the sa_restorer value returned when calling sigaction().

    $ cat /proc/$$/maps
    ...
    7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
    ...
    $ ./leak
    ...
    7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
    ...
    1 0 (nil) 0x7fb9f30b94a0
    2 4000000 (nil) 0x7f278bcaa4a0
    3 4000000 (nil) 0x7f278bcaa4a0
    4 0 (nil) 0x7fb9f30b94a0
    ...

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reported-by: Emese Revfy <re.emese@gmail.com>
    Cc: Emese Revfy <re.emese@gmail.com>
    Cc: PaX Team <pageexec@freemail.hu>
    Cc: stable@vger.kernel.org
    ---
    kernel/signal.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/kernel/signal.c b/kernel/signal.c
    index 2ec870a..8c8e3ca 100644
    --- a/kernel/signal.c
    +++ b/kernel/signal.c
    @@ -485,6 +485,9 @@ flush_signal_handlers(struct task_struct *t, int force_default)
    if (force_default || ka->sa.sa_handler != SIG_IGN)
    ka->sa.sa_handler = SIG_DFL;
    ka->sa.sa_flags = 0;
    +#ifdef __ARCH_HAS_SA_RESTORER
    + ka->sa.sa_restorer = NULL;
    +#endif
    sigemptyset(&ka->sa.sa_mask);
    ka++;
    }
    --
    1.7.9.5

    --
    Kees Cook
    Chrome OS Security


    \
     
     \ /
      Last update: 2013-03-11 21:22    [W:0.023 / U:32.792 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site