Difference between revisions of "Exploit Methods/Userspace data usage"

From Linux Kernel Security Subsystem
Jump to navigation Jump to search
Line 32: Line 32:
|style="color: red;"| nothing
|style="color: red;"| nothing
|-
|-
| v8.1
| v8.1 (since December 2014)
| hardware PAN
| hardware PAN
|-
|-
Line 39: Line 39:
|style="color: red;"| nothing
|style="color: red;"| nothing
|-
|-
| Broadwell+
| Broadwell+ (since October 2014)
| hardware PAN (SMAP)
| hardware PAN (SMAP)
|-
|-

Revision as of 19:37, 10 December 2015

Details

Sometimes an attacker won't be able to control the instruction pointer directly, but they will be able to redirect the dereference a structure or other pointer. In these cases, it is easiest to aim at malicious structures that have been built in userspace to perform the exploitation.

Note that this is a superset that includes Userspace execution. If we can protect against userspace access, we'll also be protecting against userspace execution.

Examples

Mitigations

  • hardware segmentation: SMAP (x86), PAN (arm, arm64), Domains (arm)
  • emulated PAN (memory segmentation via segments, Domains, page table swapping, PCID, etc. e.g. PAX_MEMORY_UDEREF)

Right now, the upstream options available for Privileged Access Never (PAN) are:

CPU Feature Name
ARM v7 32-bit non-LPAE CONFIG_CPU_SW_DOMAIN_PAN
v7 32-bit LPAE CONFIG_CPU_TTBR0_PAN (Catalin's series)
v8.0 32-bit CONFIG_CPU_TTBR0_PAN
v8.0 64-bit nothing
v8.1 (since December 2014) hardware PAN
x86 pre-late-Broadwell nothing
Broadwell+ (since October 2014) hardware PAN (SMAP)
s/390 hardware PAN (architectural?)
powerpc nothing?
MIPS nothing?