Messages in this thread | | | Date | Tue, 28 Aug 2018 18:25:51 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP |
| |
On Tue, Aug 28, 2018 at 05:49:01PM +0200, Jann Horn wrote: > show_opcodes() is used both for dumping kernel instructions and for dumping > user instructions. If userspace causes #PF by jumping to a kernel address, > show_opcodes() can be reached with regs->ip controlled by the user, > pointing to kernel code.
Yap, and people keep asking how to dump the running kernel, after patching and jump labels and stuff... Here's how!
:-))))
> Make sure that userspace can't trick us into > dumping kernel memory into dmesg. > > Cc: stable@vger.kernel.org > Fixes: 7cccf0725cf7 ("x86/dumpstack: Add a show_ip() function")
I think this one is more likely:
ba54d856a9d8 ("x86/fault: Dump user opcode bytes on fatal faults")
as it added the dumping of user opcode bytes.
> Reviewed-by: Kees Cook <keescook@chromium.org> > Signed-off-by: Jann Horn <jannh@google.com> > --- > v2: Andy pointed out that I probably shouldn't be doing wrapping > arithmetic on pointers. > > arch/x86/include/asm/stacktrace.h | 2 +- > arch/x86/kernel/dumpstack.c | 13 ++++++++++--- > arch/x86/mm/fault.c | 2 +- > 3 files changed, 12 insertions(+), 5 deletions(-) > > diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h > index b6dc698f992a..f335aad404a4 100644 > --- a/arch/x86/include/asm/stacktrace.h > +++ b/arch/x86/include/asm/stacktrace.h > @@ -111,6 +111,6 @@ static inline unsigned long caller_frame_pointer(void) > return (unsigned long)frame; > } > > -void show_opcodes(u8 *rip, const char *loglvl); > +void show_opcodes(struct pt_regs *regs, const char *loglvl); > void show_ip(struct pt_regs *regs, const char *loglvl); > #endif /* _ASM_X86_STACKTRACE_H */ > diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c > index 9c8652974f8e..14b337582b6f 100644 > --- a/arch/x86/kernel/dumpstack.c > +++ b/arch/x86/kernel/dumpstack.c > @@ -89,14 +89,21 @@ static void printk_stack_address(unsigned long address, int reliable, > * Thus, the 2/3rds prologue and 64 byte OPCODE_BUFSIZE is just a random > * guesstimate in attempt to achieve all of the above. > */ > -void show_opcodes(u8 *rip, const char *loglvl) > +void show_opcodes(struct pt_regs *regs, const char *loglvl) > { > #define PROLOGUE_SIZE 42 > #define EPILOGUE_SIZE 21 > #define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE) > u8 opcodes[OPCODE_BUFSIZE]; > + u8 *prologue = (u8 *)(regs->ip - PROLOGUE_SIZE); > + /* > + * Make sure userspace isn't trying to trick us into dumping kernel > + * memory by pointing the userspace instruction pointer at it. > + */ > + bool bad_ip = user_mode(regs) && > + __range_not_ok(prologue, OPCODE_BUFSIZE, TASK_SIZE_MAX); >
Ok, can we pls move the sole dumping of opcodes in a helper called, __show_opcodes(), for example, which the checking wrapper show_opcodes() - without the "__" prefix - calls?
So that show_signal_msg() can call the checking variant - show_opcodes() - as userspace might be doing monkey business there and we definitely wanna check first but __show_regs() can call the non-checking variant __show_opcodes() because there we wanna dump whatever rIP points to because we wanna know if the machine has gone off into the weeds etc, when staring at splats.
Or am I missing a security aspect here?
Thx.
-- Regards/Gruss, Boris.
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) --
| |