On Mon, 15 Apr 2019 21:23:20 -0700 Kees Cook <keesc...@chromium.org> wrote:
> Commit eab09532d400 ("binfmt_elf: use ELF_ET_DYN_BASE only for PIE"), > made changes in the rare case when the ELF loader was directly invoked > (e.g to set a non-inheritable LD_LIBRARY_PATH, testing new versions of > the loader), by moving into the mmap region to avoid both ET_EXEC and PIE > binaries. This had the effect of also moving the brk region into mmap, > which could lead to the stack and brk being arbitrarily close to each > other. An unlucky process wouldn't get its requested stack size and stack > allocations could end up scribbling on the heap. > > This is illustrated here. In the case of using the loader directly, brk > (so helpfully identified as "[heap]") is allocated with the _loader_ > not the binary. For example, with ASLR entirely disabled, you can see > this more clearly: > > $ /bin/cat /proc/self/maps > 555555554000-55555555c000 r-xp 00000000 ... /bin/cat > 55555575b000-55555575c000 r--p 00007000 ... /bin/cat > 55555575c000-55555575d000 rw-p 00008000 ... /bin/cat > 55555575d000-55555577e000 rw-p 00000000 ... [heap] > ... > 7ffff7ff7000-7ffff7ffa000 r--p 00000000 ... [vvar] > 7ffff7ffa000-7ffff7ffc000 r-xp 00000000 ... [vdso] > 7ffff7ffc000-7ffff7ffd000 r--p 00027000 ... /lib/x86_64-linux-gnu/ld-2.27.so > 7ffff7ffd000-7ffff7ffe000 rw-p 00028000 ... /lib/x86_64-linux-gnu/ld-2.27.so > 7ffff7ffe000-7ffff7fff000 rw-p 00000000 ... > 7ffffffde000-7ffffffff000 rw-p 00000000 ... [stack] > > $ /lib/x86_64-linux-gnu/ld-2.27.so /bin/cat /proc/self/maps > ... > 7ffff7bcc000-7ffff7bd4000 r-xp 00000000 ... /bin/cat > 7ffff7bd4000-7ffff7dd3000 ---p 00008000 ... /bin/cat > 7ffff7dd3000-7ffff7dd4000 r--p 00007000 ... /bin/cat > 7ffff7dd4000-7ffff7dd5000 rw-p 00008000 ... /bin/cat > 7ffff7dd5000-7ffff7dfc000 r-xp 00000000 ... /lib/x86_64-linux-gnu/ld-2.27.so > 7ffff7fb2000-7ffff7fd6000 rw-p 00000000 ... > 7ffff7ff7000-7ffff7ffa000 r--p 00000000 ... [vvar] > 7ffff7ffa000-7ffff7ffc000 r-xp 00000000 ... [vdso] > 7ffff7ffc000-7ffff7ffd000 r--p 00027000 ... /lib/x86_64-linux-gnu/ld-2.27.so > 7ffff7ffd000-7ffff7ffe000 rw-p 00028000 ... /lib/x86_64-linux-gnu/ld-2.27.so > 7ffff7ffe000-7ffff8020000 rw-p 00000000 ... [heap] > 7ffffffde000-7ffffffff000 rw-p 00000000 ... [stack] > > The solution is to move brk out of mmap and into ELF_ET_DYN_BASE since > nothing is there in this direct loader case (and ET_EXEC still far > away at 0x400000). Anything that ran before should still work (i.e. the > ultimately-launched binary already had the brk very far from its text, > so this should be no different from a COMPAT_BRK standpoint). The only > risk I see here is that if someone started to suddenly depend on the > entire memory space above the mmap region being available when launching > binaries via a direct loader execs which seems highly unlikely, I'd hope: > this would mean a binary would _not_ work when execed normally. > > Reported-by: Ali Saidi <alisa...@amazon.com> > Link: > https://lkml.kernel.org/r/CAGXu5jJ5sj3emOT2QPxQkNQk0qbU6zEfu9=omfhx_p0nckp...@mail.gmail.com > Fixes: eab09532d400 ("binfmt_elf: use ELF_ET_DYN_BASE only for PIE") > Signed-off-by: Kees Cook <keesc...@chromium.org> No cc:stable?