70 lines
2.3 KiB
Diff
70 lines
2.3 KiB
Diff
From 2ca39528c01a933f6689cd6505ce65bd6d68a530 Mon Sep 17 00:00:00 2001
|
|
From: Kees Cook <keescook@chromium.org>
|
|
Date: Wed, 13 Mar 2013 14:59:33 -0700
|
|
Subject: signal: always clear sa_restorer on execve
|
|
|
|
From: Kees Cook <keescook@chromium.org>
|
|
|
|
commit 2ca39528c01a933f6689cd6505ce65bd6d68a530 upstream.
|
|
|
|
When the new signal handlers are set up, the location of sa_restorer is
|
|
not cleared, leaking a parent process's address space location to
|
|
children. This allows for a potential bypass of the parent's ASLR by
|
|
examining the sa_restorer value returned when calling sigaction().
|
|
|
|
Based on what should be considered "secret" about addresses, it only
|
|
matters across the exec not the fork (since the VMAs haven't changed
|
|
until the exec). But since exec sets SIG_DFL and keeps sa_restorer,
|
|
this is where it should be fixed.
|
|
|
|
Given the few uses of sa_restorer, a "set" function was not written
|
|
since this would be the only use. Instead, we use
|
|
__ARCH_HAS_SA_RESTORER, as already done in other places.
|
|
|
|
Example of the leak before applying this patch:
|
|
|
|
$ cat /proc/$$/maps
|
|
...
|
|
7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
|
|
...
|
|
$ ./leak
|
|
...
|
|
7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
|
|
...
|
|
1 0 (nil) 0x7fb9f30b94a0
|
|
2 4000000 (nil) 0x7f278bcaa4a0
|
|
3 4000000 (nil) 0x7f278bcaa4a0
|
|
4 0 (nil) 0x7fb9f30b94a0
|
|
...
|
|
|
|
[akpm@linux-foundation.org: use SA_RESTORER for backportability]
|
|
Signed-off-by: Kees Cook <keescook@chromium.org>
|
|
Reported-by: Emese Revfy <re.emese@gmail.com>
|
|
Cc: Emese Revfy <re.emese@gmail.com>
|
|
Cc: PaX Team <pageexec@freemail.hu>
|
|
Cc: Al Viro <viro@zeniv.linux.org.uk>
|
|
Cc: Oleg Nesterov <oleg@redhat.com>
|
|
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
|
|
Cc: Serge Hallyn <serge.hallyn@canonical.com>
|
|
Cc: Julien Tinnes <jln@google.com>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
|
---
|
|
kernel/signal.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
--- a/kernel/signal.c
|
|
+++ b/kernel/signal.c
|
|
@@ -485,6 +485,9 @@ flush_signal_handlers(struct task_struct
|
|
if (force_default || ka->sa.sa_handler != SIG_IGN)
|
|
ka->sa.sa_handler = SIG_DFL;
|
|
ka->sa.sa_flags = 0;
|
|
+#ifdef SA_RESTORER
|
|
+ ka->sa.sa_restorer = NULL;
|
|
+#endif
|
|
sigemptyset(&ka->sa.sa_mask);
|
|
ka++;
|
|
}
|