Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation
From: Christoph Lameter <hidden>
Date: 2017-07-06 13:43:25
Also in:
lkml
On Wed, 5 Jul 2017, Kees Cook wrote:
quoted hunk ↗ jump to hunk
@@ -3536,6 +3565,9 @@ static int kmem_cache_open(struct kmem_cache *s, unsigned long flags) { s->flags = kmem_cache_flags(s->size, flags, s->name, s->ctor); s->reserved = 0; +#ifdef CONFIG_SLAB_FREELIST_HARDENED + s->random = get_random_long(); +#endif if (need_reserve_slab_rcu && (s->flags & SLAB_TYPESAFE_BY_RCU)) s->reserved = sizeof(struct rcu_head);
So if an attacker knows the internal structure of data then he can simply dereference page->kmem_cache->random to decode the freepointer. Assuming someone is already targeting a freelist pointer (which indicates detailed knowledge of the internal structure) then I would think that someone like that will also figure out how to follow the pointer links to get to the random value. Not seeing the point of all of this. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>