Exploit Methods/Userspace execution - Revision history

ChristopheLeroy: /* Mitigations */

2019-07-31T12:33:26Z

Mitigations

← Older revision		Revision as of 12:33, 31 July 2019
Line 38:		Line 38:
	\| hardware PXN (Address Spaces)		\| hardware PXN (Address Spaces)
	\|-		\|-
	\|rowspan="2"\| powerpc		\|rowspan="4"\| powerpc
	\| radix MMU (since POWER9)		\| radix MMU (since POWER9)
	\| hardware PXN (KUEP, since Linux v4.10)		\| hardware PXN (KUEP, since Linux v4.10)

2019-07-31T12:32:16Z

Mitigations

← Older revision		Revision as of 12:32, 31 July 2019
Line 42:		Line 42:
	\| hardware PXN (KUEP, since Linux v4.10)		\| hardware PXN (KUEP, since Linux v4.10)
	\|-		\|-
	\| hash MMU (since POWER7)		\| PPC64 hash MMU (since POWER7)
	\|style="color: red;"\| nothing yet, but implementation possible		\|style="color: red;"\| nothing yet, but implementation possible
			\|-
			\| PPC32 hash MMU (except 601 which doesn't have NX segment)
			\| hardware PXN (KUEP)
			\|-
			\| MPC 8xx
			\| hardware PXN (KUEP)
	\|-		\|-
	\|colspan="2"\| MIPS		\|colspan="2"\| MIPS
	\|style="color: red;"\| nothing (could use ASID switching?)		\|style="color: red;"\| nothing (could use ASID switching?)
	\|}		\|}

2019-03-25T02:40:10Z

update for powerpc

← Older revision		Revision as of 02:40, 25 March 2019
Line 38:		Line 38:
	\| hardware PXN (Address Spaces)		\| hardware PXN (Address Spaces)
	\|-		\|-
	\|~~colspan~~="2"\| powerpc		\|rowspan="2"\| powerpc
	\|style="color: red;"\| nothing?		\| radix MMU (since POWER9)
			\| hardware PXN (KUEP, since Linux v4.10)
			\|-
			\| hash MMU (since POWER7)
			\|style="color: red;"\| nothing yet, but implementation possible
	\|-		\|-
	\|colspan="2"\| MIPS		\|colspan="2"\| MIPS
	\|style="color: red;"\| nothing (could use ASID switching?)		\|style="color: red;"\| nothing (could use ASID switching?)
	\|}		\|}

2016-09-15T19:47:55Z

Details

← Older revision		Revision as of 19:47, 15 September 2016
Line 2:		Line 2:
	Once an attacker has gain control over the instruction pointers, it must be aimed somewhere. The place where attackers have the most control over memory layout tends to be in userspace, so it has been natural to place malicious code in userspace and have the kernel redirection execution there. (Frequently known as "ret2usr".)		Once an attacker has gain control over the instruction pointers, it must be aimed somewhere. The place where attackers have the most control over memory layout tends to be in userspace, so it has been natural to place malicious code in userspace and have the kernel redirection execution there. (Frequently known as "ret2usr".)

	For more details, see [[Exploit Methods/Userspace data usage\|Userspace access]], as that ~~is technically a~~ superset of userspace execution.		For more details, see [[Exploit Methods/Userspace data usage\|Userspace access]], as that can be superset of userspace execution under some emulation situations.

	= Examples =		= Examples =

2016-09-15T19:47:20Z

Mitigations

← Older revision		Revision as of 19:47, 15 September 2016
Line 8:		Line 8:

	= Mitigations =		= Mitigations =
	* hardware ~~segmentation~~: SMEP (x86), PXN (arm)		* hardware segregation: SMEP (x86), PXN (arm)
	* compiler instrumentation to set high bit on function calls		* compiler instrumentation to set high bit on function calls
	* emulate memory ~~segmentation~~ via separate page tables (e.g. PAX_MEMORY_UDEREF)		* emulate memory segregation via separate page tables (e.g. PAX_MEMORY_UDEREF)

	Right now, the upstream options available for Privileged eXecute Never (e.g. PXN, SMEP) are:		Right now, the upstream options available for Privileged eXecute Never (e.g. PXN, SMEP) are:

2016-09-15T03:59:56Z

Mitigations

← Older revision		Revision as of 03:59, 15 September 2016
Line 30:		Line 30:
	\|rowspan="2"\| x86		\|rowspan="2"\| x86
	\| pre-Ivy-Bridge		\| pre-Ivy-Bridge
	\|style="color: red;"\| nothing		\|style="color: red;"\| nothing (could use PCID?)
	\|-		\|-
	\| Ivy-Bridge+ (since May 2012)		\| Ivy-Bridge+ (since May 2012)

2016-09-15T03:55:49Z

Mitigations

← Older revision		Revision as of 03:55, 15 September 2016
Line 20:		Line 20:
	\|rowspan="3"\| ARM		\|rowspan="3"\| ARM
	\| v7 (32-bit) non-LPAE		\| v7 (32-bit) non-LPAE
	\| CONFIG_CPU_SW_DOMAIN_PAN		\| CONFIG_CPU_SW_DOMAIN_PAN (since Linux v4.3)
	\|-		\|-
	\| v7 (32-bit) LPAE (e.g. Cortex-A7, A15+)		\| v7 (32-bit) LPAE (e.g. Cortex-A7, A15+)
	\| hardware PXN		\| hardware PXN (since Linux v3.19)
	\|-		\|-
	\| v8.0+ (64-bit)		\| v8.0+ (64-bit)

2016-09-15T03:49:03Z

Mitigations

2016-04-05T18:10:27Z

Mitigations

← Older revision		Revision as of 18:10, 5 April 2016
Line 42:		Line 42:
	\|-		\|-
	\|colspan="2"\| MIPS		\|colspan="2"\| MIPS
	\|style="color: red;"\| nothing (could use ASID switching)		\|style="color: red;"\| nothing (could use ASID switching?)
	\|}		\|}

2016-04-05T18:09:06Z

Mitigations

← Older revision		Revision as of 18:09, 5 April 2016
Line 42:		Line 42:
	\|-		\|-
	\|colspan="2"\| MIPS		\|colspan="2"\| MIPS
	\|style="color: red;"\| nothing?		\|style="color: red;"\| nothing (could use ASID switching)
	\|}		\|}