Tiezhu Yang 67d0662ce9 MIPS: Prevent READ_IMPLIES_EXEC propagation ... In the MIPS architecture, we should clear the security-relevant flag READ_IMPLIES_EXEC in the function SET_PERSONALITY2() of the file arch/mips/include/asm/elf.h. Otherwise, with this flag set, PROT_READ implies PROT_EXEC for mmap to make memory executable that is not safe, because this condition allows an attacker to simply jump to and execute bytes that are considered to be just data [1]. In mm/mmap.c: unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate, struct list_head *uf) { [...] if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC)) if (!(file && path_noexec(&file->f_path))) prot |= PROT_EXEC; [...] } By the way, x86 and ARM64 have done the similar thing. After commit 250c22777f ("x86_64: move kernel"), in the file arch/x86/kernel/process_64.c: void set_personality_64bit(void) { [...] current->personality &= ~READ_IMPLIES_EXEC; } After commit 48f99c8ec0 ("arm64: Preventing READ_IMPLIES_EXEC propagation"), in the file arch/arm64/include/asm/elf.h: #define SET_PERSONALITY(ex) \ ({ \ clear_thread_flag(TIF_32BIT); \ current->personality &= ~READ_IMPLIES_EXEC; \ }) [1] https://insights.sei.cmu.edu/cert/2014/02/feeling-insecure-blame-your-parent.html Reported-by: Juxin Gao <gaojuxin@loongson.cn> Co-developed-by: Juxin Gao <gaojuxin@loongson.cn> Signed-off-by: Juxin Gao <gaojuxin@loongson.cn> Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>		2020-07-16 13:18:19 +02:00
..
asm	MIPS: Prevent READ_IMPLIES_EXEC propagation	2020-07-16 13:18:19 +02:00
uapi/asm	KVM: MIPS: Add CPUCFG emulation for Loongson-3	2020-06-04 13:51:33 -04:00