6 ms·
Seems to be fixed by this commit (in 4.8.3). commit 89eeba1594ac641a30b91942961e80fae978f839 Author: Linus Torvalds <torvalds@linux-foundation.org> Date: Thu
by the_duke 10y ago
Seems to be fixed by this commit (in 4.8.3).
commit 89eeba1594ac641a30b91942961e80fae978f839
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu Oct 13 13:07:36 2016 -0700
mm: remove gup_flags FOLL_WRITE games from __get_user_pages()
commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.
This is an ancient bug that was actually attempted to be fixed once
(badly) by me eleven years ago in commit 4ceb5db9757a ("Fix
get_user_pages() race for write access") but that was then undone due to
problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").
In the meantime, the s390 situation has long been fixed, and we can now
fix it by checking the pte_dirty() bit properly (and do it better). The
s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement
software dirty bits") which made it into v3.9. Earlier kernels will
have to look at the page state itself.
Also, the VM has become more scalable, and what used a purely
theoretical race back then has become easier to trigger.
To fix it, we introduce a new internal FOLL_COW flag to mark the "yes,
we already did a COW" rather than play racy games with FOLL_WRITE that
is very fundamental, and then use the pte dirty flag to validate that
the FOLL_COW flag is still valid.
- aexaey 10y agoAnd for earlier kernel versions, there is an STAP patch: 1) On the host, save the following in a file with the ".stp" extension: probe kernel.function("mem_write").call ? { $count = 0 } probe syscall.ptrace { // includes compat ptrace as well $request = 0xfff } 2) Install the "systemtap" package and any required dependencies. Refer to the "2. Using SystemTap" chapter in the Red Hat Enterprise Linux "SystemTap Beginners Guide" document, available from docs.redhat.com, for information on installing the required -debuginfo packages. 3) Run the "stap -g [filename-from-step-1].stp" command as root. From https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13 https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13
- geofft 10y agoDoesn't this break Upstart (which uses ptrace for service activation), meaning you really don't want to use it on RHEL 6 or Ubuntu 14.04?
- h1d 10y agoAbove link says, it would not work on rhel 5 and 6. Doesn't mention about 7 though.
- lima 10y agoNope, this only helps against one particular exploit which happens to use ptrace and /proc/self/mem.
- rodgerd 10y ago> that was then undone due to problems on s390 An interesting counter-example to the idea that "more architectures expose problems that would hide in a monoculture".
- nine_k 10y agoExpose, not solve.
- hossbeast 10y agoA link would be appreciated. The text is truncated at N columns on mobile.
- 0942v8653 10y agohttps://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails#references https://github.com/dirtycow/dirtycow.github.io/wiki/Vulnerab... and scroll up a bit. If you have an iPhone you can scroll horizontally even if it doesn't look like you can (though I am also annoyed by HN truncating the text)
- TheSpiceIsLife 10y agoThe solution is for people to stop using blockquote formatting for text and reserve it for it's intended puprose of quoting code and retaining formatting.
- hollander 10y agoThe solution is to wrap text for mobile devices. It's easy to test for screen size.
- TheSpiceIsLife 10y agoHN already has that, it's called Not doing this when you paste in a block of written material Or just doing something like this to indicate you pasted in a block of text "Or just using quotes" for chicken in chicken: chicken = chicken['chicken'] chick = chicken['chicken'] print ( chicken + '; ' + chicken ) return "blockquoting is for code"
- 0xffff2 10y agoIt's not that you can't scroll, it's just very tedious to scroll back and forth each and every line.
- 10y ago
- flukus 10y agoSo it's been a known bug for 11 years? That sounds like a pretty serious issue with the QA and or bug tracking process.
- tekacs 10y agoYup: http://arstechnica.co.uk/security/2016/09/linux-kernel-security-needs-fixing/ http://arstechnica.co.uk/security/2016/09/linux-kernel-secur...
- empath75 10y agoIt sounds like it wasn't realistically exploitable until recently.
- kasabali 10y agoLinux developers don't believe in security vulnerabilities: https://news.ycombinator.com/item?id=2539839 https://news.ycombinator.com/item?id=2539839
- AsyncAwait 10y agoThe link doesn't say what you say it does. It says that Linus thinks that security researchers want to put security at the expense of usability, which is a different thing entirely.
- digi_owl 10y agoThat, and that a bug is a bug is a bug. Any bug can potentially be a security vulnerability with the right approach. Thus putting people that find such bugs on a pedestal is counterproductive.
- mentat 10y agoAnyone who's actually operating Linux cares about security vulnerabilities more.
- deleted 10y ago[deleted]
- hilop 10y agoThis exploit is in the wild today because the fix was blocked by an obsolete hardware platform? Sigh.