Exploit Methods/Function pointer overwrite - Revision history

KeesCook: /* Mitigations */

2016-09-14T16:17:24Z

Mitigations

← Older revision		Revision as of 16:17, 14 September 2016
Line 9:		Line 9:
	= Mitigations =		= Mitigations =

			* mark function pointer tables "const" when they can be statically assigned, making them read-only for the entire kernel runtime.
	* use __ro_after_init on function pointer tables that are only written during __init so they are read-only during the rest of the kernel runtime.		* use __ro_after_init on function pointer tables that are only written during __init so they are read-only during the rest of the kernel runtime.
	* make all function pointer tables read-only at compile time (e.g. PAX_CONSTIFY_PLUGIN)		* make all function pointer tables read-only at compile time (e.g. PAX_CONSTIFY_PLUGIN).
	* make sensitive targets that need only occasional updates only writable during rare updates (e.g. PAX_KERNEXEC)		* make sensitive targets that need only occasional updates only writable during rare updates (e.g. PAX_KERNEXEC).

KeesCook: /* Mitigations */

2016-09-14T16:13:26Z

Mitigations

← Older revision		Revision as of 16:13, 14 September 2016
Line 9:		Line 9:
	= Mitigations =		= Mitigations =

	* make function pointer tables read-only (e.g. PAX_CONSTIFY_PLUGIN)		* use __ro_after_init on function pointer tables that are only written during __init so they are read-only during the rest of the kernel runtime.
	* make sensitive targets that need only occasional updates only writable during updates (e.g. PAX_KERNEXEC)		* make all function pointer tables read-only at compile time (e.g. PAX_CONSTIFY_PLUGIN)
			* make sensitive targets that need only occasional updates only writable during rare updates (e.g. PAX_KERNEXEC)

KeesCook: /* Details */

2016-09-14T16:11:30Z

Details

← Older revision		Revision as of 16:11, 14 September 2016
Line 1:		Line 1:
	= Details =		= Details =
	When an attacker has a write primitive, they can ~~start~~ function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.		When an attacker has a write primitive, they can overwrite function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.

	= Examples =		= Examples =

KeesCook: Created page with "= Details = When an attacker has a write primitive, they can start function pointers to redirect execution. Function pointers exist in a large number of places in the kernel r..."

2015-11-04T23:10:31Z

Created page with "= Details = When an attacker has a write primitive, they can start function pointers to redirect execution. Function pointers exist in a large number of places in the kernel r..."

New page

= Details =
When an attacker has a write primitive, they can start function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.

= Examples =

* [https://outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit/ security_operations overwrite]
* [https://blogs.oracle.com/ksplice/entry/anatomy_of_an_exploit_cve IDT, timer_list_fops, or security_operations overwrite]

= Mitigations =

* make function pointer tables read-only (e.g. PAX_CONSTIFY_PLUGIN)
* make sensitive targets that need only occasional updates only writable during updates (e.g. PAX_KERNEXEC)