lkml.org 
[lkml]   [2017]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH v2 1/5] binfmt_elf: Use ELF_ET_DYN_BASE only for PIE
    On Fri, Jun 23, 2017 at 1:59 PM, Kees Cook <keescook@chromium.org> wrote:
    > For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs
    > are loaded below the mmap region. This means they can be made to collide
    > (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological
    > stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs
    > above the mmap region in all cases, and will now additionally avoid
    > programs falling back to the mmap region by enforcing MAP_FIXED for
    > program loads (i.e. if it would have collided with the stack, now it
    > will fail to load instead of falling back to the mmap region).

    It was pointed out by rmk that I described this inaccurately. I mix up
    my own visualization of the address space (above/below in
    /proc/$pid/maps) with actual value comparisons (above/below
    numerically). This paragraph should read:


    For 32-bit tasks when RLIMIT_STACK is set to RLIM_INFINITY, programs
    are loaded above the mmap region. This means they can be made to collide
    (CVE-2017-1000370) or nearly collide (CVE-2017-1000371) with pathological
    stack regions. Lowering ELF_ET_DYN_BASE solves both by moving programs
    below the mmap region in all cases, and will now additionally avoid
    programs falling back to the mmap region by enforcing MAP_FIXED for
    program loads (i.e. if it would have collided with the stack, now it
    will fail to load instead of falling back to the mmap region).


    Andrew, are you able to manually adjust this commit log in -mm, or
    should I resend the patch with this paragraph corrected?

    Thanks!

    -Kees

    --
    Kees Cook
    Pixel Security

    \
     
     \ /
      Last update: 2017-06-24 21:17    [W:5.453 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site