lkml.org 
[lkml]   [2014]   [May]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 1/4] SROP mitigation: Architecture independent code for signal canaries

Architecture independent code for signal canaries

Add support for canary values in user-space signal frames. These canaries
function much like stack canaries/cookies, making it harder for an attacker to
fake a call to {rt_,}sigreturn()

This patch deals with architecture independent changes needed to support
these canaries.


These patches are meant to make Sigreturn Oriented Programming (SROP) a much
less attractive exploitation path. In Sigreturn Oriented Programming, an
attacker causes a user-space program to call the sigreturn system call in order
to get complete control control over the entire userspace context in one go.

( see: http://www.cs.vu.nl/~herbertb/papers/srop_sp14.pdf )

While mitigating SROP will probably not stop determined attackers from
exploiting a program, as there's always the much more well-known Return
Oriented Programming, we still think SROP's relative ease warrants mitigation,
especially since the mitigation is so cheap.


Signed-off-by: Erik Bosman <erik@minemu.org>

---
arch/Kconfig | 16 ++++++++++++++++
fs/exec.c | 8 ++++++++
include/linux/sched.h | 5 +++++
3 files changed, 29 insertions(+)

diff --git a/arch/Kconfig b/arch/Kconfig
index 97ff872..8319984 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -399,6 +399,22 @@ config CC_STACKPROTECTOR_STRONG

endchoice

+config HAVE_SIGNAL_CANARY
+ bool
+ help
+ An arch should select this symbol if:
+ - its struct sigframe contains a canary field
+ - it has implemented signal canary checking
+
+config SIGNAL_CANARY
+ bool "signal canary"
+ default y
+ depends on HAVE_SIGNAL_CANARY
+ help
+ Mitigate against a userland exploitation techinque called
+ sigreturn oriented programming by putting a canary value on a
+ signal's struct sigframe
+
config HAVE_CONTEXT_TRACKING
bool
help
diff --git a/fs/exec.c b/fs/exec.c
index 476f3eb..883f456 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -56,6 +56,7 @@
#include <linux/pipe_fs_i.h>
#include <linux/oom.h>
#include <linux/compat.h>
+#include <linux/random.h>

#include <asm/uaccess.h>
#include <asm/mmu_context.h>
@@ -1105,6 +1106,13 @@ void setup_new_exec(struct linux_binprm * bprm)
/* This is the point of no return */
current->sas_ss_sp = current->sas_ss_size = 0;

+#ifdef CONFIG_SIGNAL_CANARY
+ /* canary value to mitigate the use of sigreturn in (userland) exploits
+ * get_random_int() should be random enough also for 64bit
+ */
+ current->signal_canary = (unsigned long)get_random_int();
+#endif
+
if (uid_eq(current_euid(), current_uid()) && gid_eq(current_egid(), current_gid()))
set_dumpable(current->mm, SUID_DUMP_USER);
else
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 25f54c7..cb8b54b 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1364,6 +1364,11 @@ struct task_struct {

unsigned long sas_ss_sp;
size_t sas_ss_size;
+
+#ifdef CONFIG_SIGNAL_CANARY
+ u32 signal_canary; /* sigreturn exploit mitigation */
+#endif
+
int (*notifier)(void *priv);
void *notifier_data;
sigset_t *notifier_mask;
--
1.9.1


\
 
 \ /
  Last update: 2014-05-15 23:41    [W:0.042 / U:23.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site