Add a mitigation feature that will prevent user mappings at
virtual address 0, limiting the ability to convert a kernel NULL pointer dereference into a privilege escalation attack. If the sysctl is set to 0 a newly started process will not be able to map anything in the address range of the first page (0 to PAGE_SIZE). This is the default. Already running processes are not affected by this. You can either change the sysctl or the tunable from loader in case you need to map at a virtual address of 0, for example when running any of the extinct species of a set of a.out binaries, vm86 emulation, .. In that case set security.bsd.map_at_zero="1". Superseeds: r197537 In collaboration with: jhb, kib, alc
This commit is contained in:
parent
a38f6f86d2
commit
878adb8517
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=197711
@ -505,6 +505,11 @@ proc0_init(void *dummy __unused)
|
||||
pmap_pinit0(vmspace_pmap(&vmspace0));
|
||||
p->p_vmspace = &vmspace0;
|
||||
vmspace0.vm_refcnt = 1;
|
||||
|
||||
/*
|
||||
* proc0 is not expected to enter usermode, so there is no special
|
||||
* handling for sv_minuser here, like is done for exec_new_vmspace().
|
||||
*/
|
||||
vm_map_init(&vmspace0.vm_map, p->p_sysent->sv_minuser,
|
||||
p->p_sysent->sv_maxuser);
|
||||
vmspace0.vm_map.pmap = vmspace_pmap(&vmspace0);
|
||||
|
@ -122,6 +122,11 @@ u_long ps_arg_cache_limit = PAGE_SIZE / 16;
|
||||
SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
|
||||
&ps_arg_cache_limit, 0, "");
|
||||
|
||||
static int map_at_zero = 0;
|
||||
TUNABLE_INT("security.bsd.map_at_zero", &map_at_zero);
|
||||
SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RW, &map_at_zero, 0,
|
||||
"Permit processes to map an object at virtual address 0.");
|
||||
|
||||
static int
|
||||
sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS)
|
||||
{
|
||||
@ -999,7 +1004,7 @@ exec_new_vmspace(imgp, sv)
|
||||
int error;
|
||||
struct proc *p = imgp->proc;
|
||||
struct vmspace *vmspace = p->p_vmspace;
|
||||
vm_offset_t stack_addr;
|
||||
vm_offset_t sv_minuser, stack_addr;
|
||||
vm_map_t map;
|
||||
u_long ssiz;
|
||||
|
||||
@ -1015,13 +1020,17 @@ exec_new_vmspace(imgp, sv)
|
||||
* not disrupted
|
||||
*/
|
||||
map = &vmspace->vm_map;
|
||||
if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv->sv_minuser &&
|
||||
if (map_at_zero)
|
||||
sv_minuser = sv->sv_minuser;
|
||||
else
|
||||
sv_minuser = MAX(sv->sv_minuser, PAGE_SIZE);
|
||||
if (vmspace->vm_refcnt == 1 && vm_map_min(map) == sv_minuser &&
|
||||
vm_map_max(map) == sv->sv_maxuser) {
|
||||
shmexit(vmspace);
|
||||
pmap_remove_pages(vmspace_pmap(vmspace));
|
||||
vm_map_remove(map, vm_map_min(map), vm_map_max(map));
|
||||
} else {
|
||||
error = vmspace_exec(p, sv->sv_minuser, sv->sv_maxuser);
|
||||
error = vmspace_exec(p, sv_minuser, sv->sv_maxuser);
|
||||
if (error)
|
||||
return (error);
|
||||
vmspace = p->p_vmspace;
|
||||
|
Loading…
Reference in New Issue
Block a user