mmap地址随机化的问题

在团队进行漏洞利用的时候,发现对于mmap()返回的地址其实是处于一个可预测的状态的,mmap更偏向于选择一个最接近vma的地址,所以当只有攻击者能控制malloc而程序自身并不使用mmap分配时,vma会处于一个相对比较容易预测的位置,导致程序即使不知道malloc返回的地址,也可以有个相对高的可能性猜到某个位于mmap()之后区域的地址,这个ASLR绕过的问题就会比较麻烦。

而在lkml上也有相同的反馈,只不过在今年3月,这个问题已经有人提出来了,虽然还是在扯皮(到底是放在libc还是放在内核好),但是可以看一下思路。

From Ilya Smith
Subject [RFC PATCH v2 0/2] Randomization of address chosen by mmap.
Date Thu, 22 Mar 2018 19:36:36 +0300

当前实现不会将mmap返回的地址随机化。
所有熵的结尾都是基于在进程创建时选择mmap_base_addr。在此之后,mmap会产生非常可预测的地址空间布局。它允许在许多情况下绕过ASLR。此修补程序使mmap调用中的地址随机化。

v2:
改变了选择GAP的方式。现行的mmap版本中,没有试图得到所有可能的gap。在新版本中,将使用随机产生的地址,用作树的行走方向。
树采用回溯的方式遍历,直到找到合适的空隙(gap)时停止。当发现空隙时,地址从下一个VMA开始随机移动。

扩展了vm_unmapped_area_info结构,增加了新的字段random_shift ,可以用来在转移到下一个VMA开始时,设置与架构相关的限制值。
在x86-64体系结构中,32位应用程序的这种移动(shift)转换为256页,64位的为0x1000000页。

为了得到熵,代码采用了伪随机的方法。这是因为在英特尔x86-64处理器指令RDRAND在在大约10000次迭代之后(缓冲区被消耗)时工作非常缓慢。

这个特性可以通过设置randomize_va_space = 4来启用。(注:只是作者提议,似乎还没通过)

可以参看一下修改的具体内容:

Signed-off-by: Ilya Smith <blackzert@gmail.com>
---
 arch/alpha/kernel/osf_sys.c         | 1 +
 arch/arc/mm/mmap.c                  | 1 +
 arch/arm/mm/mmap.c                  | 2 ++
 arch/frv/mm/elf-fdpic.c             | 1 +
 arch/ia64/kernel/sys_ia64.c         | 1 +
 arch/ia64/mm/hugetlbpage.c          | 1 +
 arch/metag/mm/hugetlbpage.c         | 1 +
 arch/mips/mm/mmap.c                 | 1 +
 arch/parisc/kernel/sys_parisc.c     | 2 ++
 arch/powerpc/mm/hugetlbpage-radix.c | 1 +
 arch/powerpc/mm/mmap.c              | 2 ++
 arch/powerpc/mm/slice.c             | 2 ++
 arch/s390/mm/mmap.c                 | 2 ++
 arch/sh/mm/mmap.c                   | 2 ++
 arch/sparc/kernel/sys_sparc_32.c    | 1 +
 arch/sparc/kernel/sys_sparc_64.c    | 2 ++
 arch/sparc/mm/hugetlbpage.c         | 2 ++
 arch/tile/mm/hugetlbpage.c          | 2 ++
 arch/x86/kernel/sys_x86_64.c        | 4 ++++
 arch/x86/mm/hugetlbpage.c           | 4 ++++
 fs/hugetlbfs/inode.c                | 1 +
 include/linux/mm.h                  | 1 +
 mm/mmap.c                           | 3 ++-
 23 files changed, 39 insertions(+), 1 deletion(-)

+unsigned long unmapped_area_random(struct vm_unmapped_area_info *info)
+{
+   struct mm_struct *mm = current->mm;
+   struct vm_area_struct *vma = NULL;
+   struct vm_area_struct *visited_vma = NULL;
+   unsigned long entropy[2];
+   unsigned long length, low_limit, high_limit, gap_start, gap_end;
+   unsigned long addr = 0;
+
+   /* get entropy with prng */
+   prandom_bytes(&entropy, sizeof(entropy));
+   /* small hack to prevent EPERM result */
+   info->low_limit = max(info->low_limit, mmap_min_addr);
+
+   /* Adjust search length to account for worst case alignment overhead */
+   length = info->length + info->align_mask;
+   if (length < info->length)
+       return -ENOMEM;
+
+   /*
+    * Adjust search limits by the desired length.
+    * See implementation comment at top of unmapped_area().
+    */
+   gap_end = info->high_limit;
+   if (gap_end < length)
+       return -ENOMEM;
+   high_limit = gap_end - length;
+
+   low_limit = info->low_limit + info->align_mask;
+   if (low_limit >= high_limit)
+       return -ENOMEM;
+
+   /* Choose random addr in limit range */
+   addr = entropy[0] % ((high_limit - low_limit) >> PAGE_SHIFT);
+   addr = low_limit + (addr << PAGE_SHIFT);
+   addr += (info->align_offset - addr) & info->align_mask;
+
+   /* Check if rbtree root looks promising */
+   if (RB_EMPTY_ROOT(&mm->mm_rb))
+       return -ENOMEM;
+
+   vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
+   if (vma->rb_subtree_gap < length)
+       return -ENOMEM;
+   /* use randomly chosen address to find closest suitable gap */
+   while (true) {
+       gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
+       gap_end = vm_start_gap(vma);
+       if (gap_end < low_limit)
+           break;
+       if (addr < vm_start_gap(vma)) {
+           /* random said check left */
+           if (vma->vm_rb.rb_left) {
+               struct vm_area_struct *left =
+                   rb_entry(vma->vm_rb.rb_left,
+                        struct vm_area_struct, vm_rb);
+               if (addr <= vm_start_gap(left) &&
+                   left->rb_subtree_gap >= length) {
+                   vma = left;
+                   continue;
+               }
+           }
+       } else if (addr >= vm_end_gap(vma)) {
+           /* random said check right */
+           if (vma->vm_rb.rb_right) {
+               struct vm_area_struct *right =
+               rb_entry(vma->vm_rb.rb_right,
+                    struct vm_area_struct, vm_rb);
+               /* it want go to the right */
+               if (right->rb_subtree_gap >= length) {
+                   vma = right;
+                   continue;
+               }
+           }
+       }
+       if (gap_start < low_limit) {
+           if (gap_end <= low_limit)
+               break;
+           gap_start = low_limit;
+       } else if (gap_end > info->high_limit) {
+           if (gap_start >= info->high_limit)
+               break;
+           gap_end = info->high_limit;
+       }
+       if (gap_end > gap_start &&
+           gap_end - gap_start >= length)
+           goto found;
+       visited_vma = vma;
+       break;
+   }
+   /* not found */
+   while (true) {
+       gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
+
+       if (gap_start <= high_limit && vma->vm_rb.rb_right) {
+           struct vm_area_struct *right =
+               rb_entry(vma->vm_rb.rb_right,
+                    struct vm_area_struct, vm_rb);
+           if (right->rb_subtree_gap >= length &&
+               right != visited_vma) {
+               vma = right;
+               continue;
+           }
+       }
+
+check_current:
+       /* Check if current node has a suitable gap */
+       gap_end = vm_start_gap(vma);
+       if (gap_end <= low_limit)
+           goto go_back;
+
+       if (gap_start < low_limit)
+           gap_start = low_limit;
+
+       if (gap_start <= high_limit &&
+           gap_end > gap_start && gap_end - gap_start >= length)
+           goto found;
+
+       /* Visit left subtree if it looks promising */
+       if (vma->vm_rb.rb_left) {
+           struct vm_area_struct *left =
+               rb_entry(vma->vm_rb.rb_left,
+                    struct vm_area_struct, vm_rb);
+           if (left->rb_subtree_gap >= length &&
+               vm_end_gap(left) > low_limit &&
+               left != visited_vma) {
+               vma = left;
+               continue;
+           }
+       }
+go_back:
+       /* Go back up the rbtree to find next candidate node */
+       while (true) {
+           struct rb_node *prev = &vma->vm_rb;
+
+           if (!rb_parent(prev))
+               return -ENOMEM;
+           visited_vma = vma;
+           vma = rb_entry(rb_parent(prev),
+                      struct vm_area_struct, vm_rb);
+           if (prev == vma->vm_rb.rb_right) {
+               gap_start = vma->vm_prev ?
+                   vm_end_gap(vma->vm_prev) : low_limit;
+               goto check_current;
+           }
+       }
+   }
+found:
+   /* We found a suitable gap. Clip it with the original high_limit. */
+   if (gap_end > info->high_limit)
+       gap_end = info->high_limit;
+   gap_end -= info->length;
+   gap_end -= (gap_end - info->align_offset) & info->align_mask;
+   /* only one suitable page */
+   if (gap_end ==  gap_start)
+       return gap_start;
+   addr = entropy[1] % (min((gap_end - gap_start) >> PAGE_SHIFT,
+                            0x10000UL));
+   addr = gap_end - (addr << PAGE_SHIFT);
+   addr += (info->align_offset - addr) & info->align_mask;
+   return addr;
+}
+
 unsigned long unmapped_area(struct vm_unmapped_area_info *info)
 {
    /*
-- 
2.7.4

标签:none

添加新评论

captcha
请输入验证码