Messages in this thread | | | From | "Tobin C. Harding" <> | Subject | [PATCH V8 0/2] printk: hash addresses printed with %p | Date | Thu, 26 Oct 2017 13:53:54 +1100 |
| |
Currently there are many places in the kernel where addresses are being printed using an unadorned %p. Kernel pointers should be printed using %pK allowing some control via the kptr_restrict sysctl. Exposing addresses gives attackers sensitive information about the kernel layout in memory.
We can reduce the attack surface by hashing all addresses printed with %p. This will of course break some users, forcing code printing needed addresses to be updated.
With this version we include hashing of malformed specifiers also. Malformed specifiers include incomplete (e.g %pi) and also non-existent specifiers. checkpatch should warn for non-existent specifiers but AFAICT won't warn for incomplete specifiers.
Here is the behaviour that this set implements.
For kpt_restrict==0
Randomness not ready: printed with %p: (pointer) # NOTE: with padding Valid pointer: printed with %pK: deadbeefdeadbeef printed with %p: 0xdeadbeef malformed specifier (eg %i): 0xdeadbeef NULL pointer: printed with %pK: 0000000000000000 printed with %p: (null) # NOTE: no padding malformed specifier (eg %i): (null)
For kpt_restrict==2
Valid pointer: printed with %pK: 0000000000000000
All other output as for kptr_restrict==0
V8: - Add second patch cleaning up null pointer printing in pointer() - Move %pK handling to separate function, further cleaning up pointer() - Move ptr_to_id() call outside of switch statement making hashing the default behaviour (including malformed specifiers). - Remove use of static_key, replace with simple boolean.
V7: - Use tabs instead of spaces (ouch!).
V6: - Use __early_initcall() to fill the SipHash key. - Use static keys to guard hashing before the key is available.
V5: - Remove spin lock. - Add Jason A. Donenfeld to CC list by request. - Add Theodore Ts'o to CC list due to comment on previous version.
V4: - Remove changes to siphash.{ch} - Do word size check, and return value cast, directly in ptr_to_id(). - Use add_ready_random_callback() to guard call to get_random_bytes()
V3: - Use atomic_xchg() to guard setting [random] key. - Remove erroneous white space change.
V2: - Use SipHash to do the hashing.
The discussion related to this patch has been fragmented. There are three threads associated with this patch. Email threads by subject:
[PATCH] printk: hash addresses printed with %p [PATCH 0/3] add %pX specifier [kernel-hardening] [RFC V2 0/6] add more kernel pointer filter options
Tobin C. Harding (2): printk: remove tabular output for NULL pointer printk: hash addresses printed with %p
lib/vsprintf.c | 166 +++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 108 insertions(+), 58 deletions(-)
-- 2.7.4
| |