6 ms·
Someone in the Phoronix comments wondered why not just map it (the kernel-assisted trampoline memory page) executable and not writeable, to avoid the attack sur
by jchw 6y ago
Someone in the Phoronix comments wondered why not just map it (the kernel-assisted trampoline memory page) executable and not writeable, to avoid the attack surface but be significantly faster. I also wonder exactly why, admittedly I haven’t read the mailing list thread entirely but purely working on theory I wonder what the advantages of working on page fault is. Less abusable gadgets in memory? More flexibility? Perhaps additional Spectre-type mitigations?
- sild 6y agoCurrently the page must be writeable at some point in order to create the trampoline. A page fault is used as a way of executing the trampoline without the page having to be made executable/writable---the page fault handler recognises the page as a special trampoline page and handles the jump to the trampolines target address (which was previously registered using the new syscall). Note that AFAICS this is unrelated to Spectre. The intended use is for constructing closures for use in FFI libraries such as libffi. EDIT: I think I perhaps misunderstood your query---are you saying why not just make a system call where the kernel creates the page for you with the desired trampoline code and execute permissions?
- ori_b 6y agoDouble map it, like a JIT does. Once writable, and once executable. Put the pointers into different shared objects so that ASLR puts a randomized offset between them and you can't discover the write pointers from the execute pointer, and vice versa.
- vardump 6y agoYou still need to store the write pointers somewhere. So this very quickly becomes a game of cat and mouse.
- saagarjha 6y agoJavaScriptCore had an amusing scheme where they'd make an (executable) memcpy gadget with the address hardcoded, then throw away read permissions to that memory. So the pointer's address is thus not readable without modifying memory permissions.
- jchw 6y agoYes, the edit is precisely what I was trying to get at. Do you happen to have context around this? edit: also, “spectre mitigations” was just a shot in the dark. It does feel like this mode of jmping (modifying saved registers and restoring them) would be more prone to interfering with speculative execution.
- StillBored 6y agoIts a good question, and one that seem to be unspoken. I'm guessing, the charitable version could be that the implementation on a major processor vendor works out to be just the right amount of security because the page fault handler wasn't optimized as heavily as the syscall interface. So, this might provide better security on a "slower" path, which turns out to actually be faster once the faster path is fully secured?
- saagarjha 6y agoInterestingly on ARM64 such mappings are prohibited, since this breaks PAN (the spec requires it: https://siguza.github.io/PAN/ https://siguza.github.io/PAN/).
- jchw 6y agoHmmm. So maybe this is a reasonable explanation.