Skip to content

Commit

Permalink
MIPS: Prevent READ_IMPLIES_EXEC propagation
Browse files Browse the repository at this point in the history
In the MIPS architecture, we should clear the security-relevant
flag READ_IMPLIES_EXEC in the function SET_PERSONALITY2() of the
file arch/mips/include/asm/elf.h.

Otherwise, with this flag set, PROT_READ implies PROT_EXEC for
mmap to make memory executable that is not safe, because this
condition allows an attacker to simply jump to and execute bytes
that are considered to be just data [1].

In mm/mmap.c:
unsigned long do_mmap(struct file *file, unsigned long addr,
			unsigned long len, unsigned long prot,
			unsigned long flags, vm_flags_t vm_flags,
			unsigned long pgoff, unsigned long *populate,
			struct list_head *uf)
{
	[...]
	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
		if (!(file && path_noexec(&file->f_path)))
			prot |= PROT_EXEC;
	[...]
}

By the way, x86 and ARM64 have done the similar thing.

After commit 250c227 ("x86_64: move kernel"), in the file
arch/x86/kernel/process_64.c:
void set_personality_64bit(void)
{
	[...]
	current->personality &= ~READ_IMPLIES_EXEC;
}

After commit 48f99c8 ("arm64: Preventing READ_IMPLIES_EXEC
propagation"), in the file arch/arm64/include/asm/elf.h:
#define SET_PERSONALITY(ex)						\
({									\
	clear_thread_flag(TIF_32BIT);					\
	current->personality &= ~READ_IMPLIES_EXEC;			\
})

[1] https://insights.sei.cmu.edu/cert/2014/02/feeling-insecure-blame-your-parent.html

Reported-by: Juxin Gao <gaojuxin@loongson.cn>
Co-developed-by: Juxin Gao <gaojuxin@loongson.cn>
Signed-off-by: Juxin Gao <gaojuxin@loongson.cn>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
  • Loading branch information
Tiezhu Yang authored and Thomas Bogendoerfer committed Jul 16, 2020
1 parent a859647 commit 67d0662
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions arch/mips/include/asm/elf.h
Original file line number Diff line number Diff line change
Expand Up @@ -410,6 +410,7 @@ do { \
clear_thread_flag(TIF_32BIT_FPREGS); \
clear_thread_flag(TIF_HYBRID_FPREGS); \
clear_thread_flag(TIF_32BIT_ADDR); \
current->personality &= ~READ_IMPLIES_EXEC; \
\
if ((ex).e_ident[EI_CLASS] == ELFCLASS32) \
__SET_PERSONALITY32(ex, state); \
Expand Down

0 comments on commit 67d0662

Please sign in to comment.