LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Robin Murphy <robin.murphy@arm.com>
To: Jun Yao <yaojun8558363@gmail.com>, linux-arm-kernel@lists.infradead.org
Cc: catalin.marinas@arm.com, will.deacon@arm.com,
	linux-kernel@vger.kernel.org, greg@kroah.com,
	kernel-hardening@lists.openwall.com
Subject: Re: [PATCH 0/4] arm64/mm: migrate swapper_pg_dir
Date: Fri, 1 Jun 2018 10:42:10 +0100	[thread overview]
Message-ID: <41dbb7d5-c9a5-3ed2-c0fe-a8bb8a3e487f@arm.com> (raw)
In-Reply-To: <20180601080819.11712-1-yaojun8558363@gmail.com>

On 01/06/18 09:08, Jun Yao wrote:
> Currently, The offset between swapper_pg_dir and _text is
> fixed. When attackers know the address of _text(no KASLR or
> breaking KASLR), they can caculate the address of
> swapper_pg_dir. Then KSMA(Kernel Space Mirroring Attack) can
> be applied.
> 
> The principle of KSMA is to insert a carefully constructed PGD
> entry into the translation table. The type of this entry is

Out of interest, how does that part work? AFAICS, modifying a PGD entry 
involves writing to kernel memory, which would mean the implication of 
KSMA is "userspace can gain write permission to kernel memory by writing 
to kernel memory" - that doesn't sound like an attack in itself, more 
just a convenience for ease of exploiting whatever successful attack got 
you in there in the first place.

That's not to say that it isn't still worth mitigating, I'm just 
questioning the given rationale here.

Robin.

> block, which maps the kernel text and its access permissions
> bits are 01. The user process can then modify kernel text
> directly through this mapping.
> 
> To protect against KSMA, these patches migrate swapper_pg_dir
> to new place, which is dynamically allocated. Since it is
> allocated during the kernel boot process and the address is
> relatively fixed, further randomization may be required.
> 
> Jun Yao (4):
>    arm64/mm: pass swapper_pg_dir as an argument to __enable_mmu()
>    arm64/mm: introduce variable to save new swapper_pg_dir address
>    arm64/mm: make tramp_pg_dir and swapper_pg_dir adjacent
>    arm64/mm: migrate swapper_pg_dir and tramp_pg_dir
> 
>   arch/arm64/include/asm/mmu_context.h |  6 +--
>   arch/arm64/include/asm/pgtable.h     |  2 +
>   arch/arm64/kernel/cpufeature.c       |  2 +-
>   arch/arm64/kernel/entry.S            |  4 +-
>   arch/arm64/kernel/head.S             | 10 ++--
>   arch/arm64/kernel/hibernate.c        |  2 +-
>   arch/arm64/kernel/sleep.S            |  2 +
>   arch/arm64/kernel/vmlinux.lds.S      |  9 ++--
>   arch/arm64/mm/kasan_init.c           |  6 +--
>   arch/arm64/mm/mmu.c                  | 75 +++++++++++++++++-----------
>   10 files changed, 71 insertions(+), 47 deletions(-)
> 

  reply	other threads:[~2018-06-01  9:42 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-01  8:08 Jun Yao
2018-06-01  9:42 ` Robin Murphy [this message]
  -- strict thread matches above, loose matches on Subject: below --
2018-06-04  9:13 Jun Yao
2018-05-30  9:12 YaoJun

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=41dbb7d5-c9a5-3ed2-c0fe-a8bb8a3e487f@arm.com \
    --to=robin.murphy@arm.com \
    --cc=catalin.marinas@arm.com \
    --cc=greg@kroah.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=will.deacon@arm.com \
    --cc=yaojun8558363@gmail.com \
    --subject='Re: [PATCH 0/4] arm64/mm: migrate swapper_pg_dir' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).