oss-sec mailing list archives
Re: PIE bypass using VDSO ASLR weakness - Linux kernel
From: Andy Lutomirski <luto () amacapital net>
Date: Sun, 18 Jan 2015 11:35:42 -0800
On 01/09/2015 08:18 AM, cve-assign-AZamIotjMK3YtjvyW6yDsg () public gmane org wrote:
Given that ASLR is not effective in VDSO and comes down to 11 quality bits as per pax test making return-to-vdso feasible even for PIE binary, whether this should be considered as a bug and CVE be assigned?Yes, we can proceed to CVE assignment. The more recent discussion hasn't been on oss-security with, for example:https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vdso&id=bc3b94c31d65e761ddfe150d02932c65971b74e2 http://marc.info/?l=linux-kernel&m=141911002822659&w=2This apparently mentions both the original discovery:The current algorithm is buggy: the vdso has about a 50% probability of being at the very end of a PMD.Use CVE-2014-9585 for this vulnerability, which corresponds to a portion of the above bc3b94c31d65e761ddfe150d02932c65971b74e2 patch. (not yet available at http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/arch/x86/vdso/vma.c)and a second discovery that was made separately:The current algorithm also has a decent chance of failing outright due to incorrect handling of the case where the top of the stack is near the top of its PMD.Here, our question, for anyone, is: is there a security impact from the "failing outright" outcome? Or is there only a performance impact (e.g., any correctly written application will continue to work, but will not benefit from any vDSO functionality)?We haven't seen any responses. There is currently no CVE ID for this "incorrect handling of the case where the top of the stack is near the top of its PMD" issue. This incorrect-handling issue is not within the scope of CVE-2014-9585.
The "failing outright" case causes the vdso randomization process to fail, resulting in the vdso being mapped at the top of mmap space. Given that the mmap space is itself usually randomized, this seems unlikely to be a security issue. --Andy
Current thread:
- Re: PIE bypass using VDSO ASLR weakness - Linux kernel cve-assign (Jan 09)
- Re: PIE bypass using VDSO ASLR weakness - Linux kernel Andy Lutomirski (Jan 18)