Messages in this thread | | | Date | Wed, 11 Mar 2020 10:44:09 -0700 | From | Kees Cook <> | Subject | Re: [PATCH] slub: Relocate freelist pointer to middle of object |
| |
From: Christopher Lameter > Sent: 08 March 2020 19:21 > > On Thu, 5 Mar 2020, Kees Cook wrote: > > > Instead of having the freelist pointer at the very beginning of an > > allocation (offset 0) or at the very end of an allocation (effectively > > offset -sizeof(void *) from the next allocation), move it away from > > the edges of the allocation and into the middle. This provides some > > protection against small-sized neighboring overflows (or underflows), > > for which the freelist pointer is commonly the target. (Large or well > > controlled overwrites are much more likely to attack live object contents, > > instead of attempting freelist corruption.) > > Sounds good. You could even randomize the position to avoid attacks on via > the freelist pointer.
That's a good point. "offset" is just calculated once, and for many slabs, the available space is quite large. I wonder what the best practice might be for how far from the edge to stay. Hmmm. Maybe simply carve it into thirds, and randomize the offset within the middle third?
-- Kees Cook
| |