On Sun, Sep 12, 2021 at 06:20:30PM +0200, Len Baker wrote:

I am taking a look to the issues in the Kernel Self Protection Project [1] and this one [2] (perform taint-tracking of writes to kernel addresses that came from userspace) take my attention. Reading the explanation does not make it clear to me where the flaw is.

[extracted from the KSPP]

It should be possible to perform taint tracking of addresses in the kernel to avoid flaws of the form:

copy_from_user(object, src, ...); ... memcpy(object.address, something, ...);

[end of extracted]

My question is: Why is this scenario a flaw?

If I understand correctly, the copy_from_user() function copies n bytes of src (in user space address) to object (in kernel space address). I think that it is the correct way to act. Then, in kernel space the object is modified. So, I don't see the problem. Sorry if it is a trivial question but I can not figure it out on my own.

I suppose the problem is that userspace sets the value of object.address to point to something dangerous. If the kernel tries to write to that location later it will cause a crash or worse... -- Valentin

Hi all! On 12/09/2021 18:20, Len Baker wrote: [...]

[extracted from the KSPP]

It should be possible to perform taint tracking of addresses in the kernel to avoid flaws of the form:

copy_from_user(object, src, ...); ... memcpy(object.address, something, ...);

[end of extracted]

My question is: Why is this scenario a flaw?

If I understand correctly, the copy_from_user() function copies n bytes of src (in user space address) to object (in kernel space address). I think > that it is the correct way to act. Then, in kernel space the object is

Yup.

modified. So, I don't see the problem. Sorry if it is a trivial question but I can not figure it out on my own.

Shouldn't the memcpy() be a copy_to_user() as object.address is setup by the user space and thus a user space address? MfG, Bernd -- Bernd Petrovitsch Email : bernd@petrovitsch.priv.at There is NO CLOUD, just other people's computers. - FSFE LUGA : http://www.luga.at

On Sun, Sep 12, 2021 at 9:21 AM Len Baker <len.baker@gmx.com> wrote:

It should be possible to perform taint tracking of addresses in the kernel to avoid flaws of the form:

copy_from_user(object, src, ...); ... memcpy(object.address, something, ...);

[end of extracted]

My question is: Why is this scenario a flaw?

Because of the first argument of memcpy.

If I understand correctly, the copy_from_user() function copies n bytes of src (in user space address) to object (in kernel space address). I think that it is the correct way to act.

Yes.

Then, in kernel space the object is modified.

Not necessarily. The object would be modified if memcpy(&object.address, something, ...); was written. Without taking the address it is likely modifying something else.