4 ms·

This vulnerability is a great advertisement for grsecurity/PaX, which mitigates it at the source of the issue thanks to PAX_REFCOUNT.

corv 11y ago
Unfortunately no major distributions ship those patches by default.
- eloy 11y ago
  Why don't they? There are not that much performance downsides to PaX/grsecurity AFAIK. And it doesn't break the ABI monthly like OpenBSD does. (Don't get me wrong, I like OpenBSD personally, but this is not suitable for enterprises) I don't agree with Torvalds, but at least I can understand him. I don't understand why distros don't implement it. http://www.washingtonpost.com/sf/business/2015/11/05/net-of-insecurity-the-kernel-of-the-argument/ http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...
  - cesarb 11y ago
    Distributions prefer to minimize divergence from upstream, and therefore tend to avoid non-upstreamed patches.
  - baghira 11y ago
    While the fact that since last fall grsecurity only ships the stable branch of the patchset for sponsors (because of persistent trademarks violations) doesn't help integration in smaller distributions (also Debian, I would guess), I am always baffled as to why grsecurity/Pax were never chosen by a distro like Suse to differentiate itself from Red Hat.
- iheartmemcache 11y ago
  FYI: If you're comfortable with Gentoo, the jump to Hardened Gentoo[1] is an easy one[2] and gives TrustedBSD[3] a run for its money w/r/t out-of-the-box security. It has the SElinux MAC, role based access controlled stuff from GRsec alternatively [you can mix and match GRsec + SElinux except for RBAC and SElinux's ACL system), grsec's ASLR at runtime, modified versions of musl/uclibc, stack protection support (why anyone would write software that could possibly be EIP exploited with countless ASan damn well integrated into some compilers, I haven't a clue), and a whole host more. Some interesting academic work: http://hmarco.org/data/OnTheEffectivness-NX-SSP-RenewSSP-and-ASLR.pdf http://hmarco.org/data/OnTheEffectivness-NX-SSP-RenewSSP-and... While SSP is not enough, (use PIE too): http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.ht... A fun toy: https://github.com/JhetoX/VectorAttackScanner https://github.com/JhetoX/VectorAttackScanner [1]https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened [2]https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Harden... [3]Granted I haven't used it in ages, it's still the benchmark I use in my mind, back when Linux 2.2 was rife with out-of-the-box ROP vulns.
- garrettr_ 11y ago
  Freedom of the Press Foundation (disclosure: I am an employee) ships grsecurity kernels for SecureDrop. You have to build them yourself, but it really isn't that hard to do. We're working on making this easier for everybody by publishing guides [0] to building your own grsecurity kernel, as well as developing an Ansible playbook to automate building hardened kernels [1]. This is all still a work in progress, but expect a blog post once what we have is more polished. A relatively easy-to-follow blog post was recently published that guides you through building a grsecurity kernel for a Debian desktop installation: [2]. grsecurity was operating a service last year that would allow you to request custom built kernels for a small price, although I can't find it now so it may have been taken offline. This is an ideal solution, and is actually better than packaging the kernels in an distribution's repository, because some of grsecurity's security features are more effective when everybody is running a unique kernel (e.g. RANDSTRUCT). Finally, the linux-hardening group is working on upstreaming select PaX features into the mainline kernel [3], including PAX_REFCOUNT, which is the protection that would've mitigated this particular vulnerability. [0]: https://gist.github.com/ageis/a91f36ca99c252291a00 https://gist.github.com/ageis/a91f36ca99c252291a00 [1]: https://github.com/freedomofpress/grsec/ https://github.com/freedomofpress/grsec/ [2]: https://micahflee.com/2016/01/debian-grsecurity/ https://micahflee.com/2016/01/debian-grsecurity/ [3]: http://lwn.net/Articles/668876/ http://lwn.net/Articles/668876/
- petra 11y ago
  Copperhead-os is an open-source android ROM that includes the security features of grsecurity. It runs on nexus-5 and Galaxy-S4. https://copperhead.co/android/ https://copperhead.co/android/ Which of course ,raises the question: Why doesn't Google integrate this into android, or at the very least for a secure/business version of android ?
  - eloy 11y ago
    And it's not vulnerable: https://twitter.com/CopperheadSec/status/689553753423216641 https://twitter.com/CopperheadSec/status/689553753423216641
- heinrich5991 11y ago
  Arch Linux does: https://www.archlinux.org/packages/?name=linux-grsec https://www.archlinux.org/packages/?name=linux-grsec
  - eloy 11y ago
    > by default Arch don't even have coreutils "by default". Yes, I know, you're supposed to install them anyway, but if you follow the standard install guide, there is no GRsec.
    - heinrich5991 11y ago
      Oh, I interpreted the "by default" as "being installable without compiling it from source". But I guess more distros are able to do that.
Zolomon 11y ago
Insomnihack just had a teaser CTF[1] where one of the challenges was to find an exploit in a poorly configured grsecurity-based Linux installation from an archive of the filesystem that was exposing a CGI based web server. It was a really fun challenge! [1] https://ctftime.org/event/258 https://ctftime.org/event/258

corv 11y ago

Unfortunately no major distributions ship those patches by default.

eloy 11y ago
Why don't they? There are not that much performance downsides to PaX/grsecurity AFAIK. And it doesn't break the ABI monthly like OpenBSD does. (Don't get me wrong, I like OpenBSD personally, but this is not suitable for enterprises) I don't agree with Torvalds, but at least I can understand him. I don't understand why distros don't implement it. http://www.washingtonpost.com/sf/business/2015/11/05/net-of-insecurity-the-kernel-of-the-argument/ http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...
- cesarb 11y ago
  Distributions prefer to minimize divergence from upstream, and therefore tend to avoid non-upstreamed patches.
- baghira 11y ago
  While the fact that since last fall grsecurity only ships the stable branch of the patchset for sponsors (because of persistent trademarks violations) doesn't help integration in smaller distributions (also Debian, I would guess), I am always baffled as to why grsecurity/Pax were never chosen by a distro like Suse to differentiate itself from Red Hat.
iheartmemcache 11y ago
FYI: If you're comfortable with Gentoo, the jump to Hardened Gentoo[1] is an easy one[2] and gives TrustedBSD[3] a run for its money w/r/t out-of-the-box security. It has the SElinux MAC, role based access controlled stuff from GRsec alternatively [you can mix and match GRsec + SElinux except for RBAC and SElinux's ACL system), grsec's ASLR at runtime, modified versions of musl/uclibc, stack protection support (why anyone would write software that could possibly be EIP exploited with countless ASan damn well integrated into some compilers, I haven't a clue), and a whole host more. Some interesting academic work: http://hmarco.org/data/OnTheEffectivness-NX-SSP-RenewSSP-and-ASLR.pdf http://hmarco.org/data/OnTheEffectivness-NX-SSP-RenewSSP-and... While SSP is not enough, (use PIE too): http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.ht... A fun toy: https://github.com/JhetoX/VectorAttackScanner https://github.com/JhetoX/VectorAttackScanner [1]https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened [2]https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Harden... [3]Granted I haven't used it in ages, it's still the benchmark I use in my mind, back when Linux 2.2 was rife with out-of-the-box ROP vulns.
garrettr_ 11y ago
Freedom of the Press Foundation (disclosure: I am an employee) ships grsecurity kernels for SecureDrop. You have to build them yourself, but it really isn't that hard to do. We're working on making this easier for everybody by publishing guides [0] to building your own grsecurity kernel, as well as developing an Ansible playbook to automate building hardened kernels [1]. This is all still a work in progress, but expect a blog post once what we have is more polished. A relatively easy-to-follow blog post was recently published that guides you through building a grsecurity kernel for a Debian desktop installation: [2]. grsecurity was operating a service last year that would allow you to request custom built kernels for a small price, although I can't find it now so it may have been taken offline. This is an ideal solution, and is actually better than packaging the kernels in an distribution's repository, because some of grsecurity's security features are more effective when everybody is running a unique kernel (e.g. RANDSTRUCT). Finally, the linux-hardening group is working on upstreaming select PaX features into the mainline kernel [3], including PAX_REFCOUNT, which is the protection that would've mitigated this particular vulnerability. [0]: https://gist.github.com/ageis/a91f36ca99c252291a00 https://gist.github.com/ageis/a91f36ca99c252291a00 [1]: https://github.com/freedomofpress/grsec/ https://github.com/freedomofpress/grsec/ [2]: https://micahflee.com/2016/01/debian-grsecurity/ https://micahflee.com/2016/01/debian-grsecurity/ [3]: http://lwn.net/Articles/668876/ http://lwn.net/Articles/668876/
petra 11y ago
Copperhead-os is an open-source android ROM that includes the security features of grsecurity. It runs on nexus-5 and Galaxy-S4. https://copperhead.co/android/ https://copperhead.co/android/ Which of course ,raises the question: Why doesn't Google integrate this into android, or at the very least for a secure/business version of android ?
- eloy 11y ago
  And it's not vulnerable: https://twitter.com/CopperheadSec/status/689553753423216641 https://twitter.com/CopperheadSec/status/689553753423216641
heinrich5991 11y ago
Arch Linux does: https://www.archlinux.org/packages/?name=linux-grsec https://www.archlinux.org/packages/?name=linux-grsec
- eloy 11y ago
  > by default Arch don't even have coreutils "by default". Yes, I know, you're supposed to install them anyway, but if you follow the standard install guide, there is no GRsec.
  - heinrich5991 11y ago
    Oh, I interpreted the "by default" as "being installable without compiling it from source". But I guess more distros are able to do that.

Zolomon 11y ago

Insomnihack just had a teaser CTF[1] where one of the challenges was to find an exploit in a poorly configured grsecurity-based Linux installation from an archive of the filesystem that was exposing a CGI based web server. It was a really fun challenge! [1] https://ctftime.org/event/258 https://ctftime.org/event/258