github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-18 13:30:40 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
e4fd970752
linux/arch
History
Tiezhu Yang 67d0662ce9 MIPS: Prevent READ_IMPLIES_EXEC propagation 
In the MIPS architecture, we should clear the security-relevant
flag READ_IMPLIES_EXEC in the function SET_PERSONALITY2() of the
file arch/mips/include/asm/elf.h.

Otherwise, with this flag set, PROT_READ implies PROT_EXEC for
mmap to make memory executable that is not safe, because this
condition allows an attacker to simply jump to and execute bytes
that are considered to be just data [1].

In mm/mmap.c:
unsigned long do_mmap(struct file *file, unsigned long addr,
			unsigned long len, unsigned long prot,
			unsigned long flags, vm_flags_t vm_flags,
			unsigned long pgoff, unsigned long *populate,
			struct list_head *uf)
{
	[...]
	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
		if (!(file && path_noexec(&file->f_path)))
			prot |= PROT_EXEC;
	[...]
}

By the way, x86 and ARM64 have done the similar thing.

After commit 250c22777f ("x86_64: move kernel"), in the file
arch/x86/kernel/process_64.c:
void set_personality_64bit(void)
{
	[...]
	current->personality &= ~READ_IMPLIES_EXEC;
}

After commit 48f99c8ec0 ("arm64: Preventing READ_IMPLIES_EXEC
propagation"), in the file arch/arm64/include/asm/elf.h:
#define SET_PERSONALITY(ex)						\
({									\
	clear_thread_flag(TIF_32BIT);					\
	current->personality &= ~READ_IMPLIES_EXEC;			\
})

[1] https://insights.sei.cmu.edu/cert/2014/02/feeling-insecure-blame-your-parent.html

Reported-by: Juxin Gao <gaojuxin@loongson.cn>
Co-developed-by: Juxin Gao <gaojuxin@loongson.cn>
Signed-off-by: Juxin Gao <gaojuxin@loongson.cn>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2020-07-16 13:18:19 +02:00
..
alpha Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
arc treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
arm Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
arm64 Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
c6x This time around we have 4 lines of diff in the core framework, removing a 2020-06-10 11:42:19 -07:00
csky mmap locking API: use coccinelle to convert mmap_sem rwsem call sites 2020-06-09 09:39:14 -07:00
h8300 This time around we have 4 lines of diff in the core framework, removing a 2020-06-10 11:42:19 -07:00
hexagon treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ia64 treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
m68k Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
microblaze mmap locking API: convert mmap_sem comments 2020-06-09 09:39:14 -07:00
mips MIPS: Prevent READ_IMPLIES_EXEC propagation 2020-07-16 13:18:19 +02:00
nds32 mmap locking API: convert mmap_sem comments 2020-06-09 09:39:14 -07:00
nios2 nios2 update for v5.8-rc1 2020-06-12 11:55:11 -07:00
openrisc OpenRISC updates for 5.8 2020-06-13 10:54:09 -07:00
parisc treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
powerpc Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
riscv RISC-V Patches for the 5.8 Merge Window, Part 2 2020-06-11 12:55:20 -07:00
s390 Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
sh treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sparc treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
um treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
unicore32 This time around we have 4 lines of diff in the core framework, removing a 2020-06-10 11:42:19 -07:00
x86 Kbuild updates for v5.8 (2nd) 2020-06-13 13:29:16 -07:00
xtensa mmap locking API: convert mmap_sem API comments 2020-06-09 09:39:14 -07:00
.gitignore
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00