3 ms·
io_uring is a security nightmare.
by Thaxll 1y ago
io_uring is a security nightmare.
- pjc50 1y agoHow so?
- Thaxll 1y agoThis is a good read on the topic: https://chomp.ie/Blog+Posts/Put+an+io_uring+on+it+-+Exploiting+the+Linux+Kernel https://chomp.ie/Blog+Posts/Put+an+io_uring+on+it+-+Exploiti...
- sim7c00 1y agoyou give process direct access to a piece of kernel memory. its a reason why there is separation. thats all.
- wtallis 1y agoMost of the security concerns with io_uring that I've seen aren't related to the shared buffers at all but simply stem from the fact that io_uring is a mechanism to instruct the kernel to do stuff without making system calls, so security measures that focus on what system calls a process is allowed to do are ineffective.
- loeg 1y agoThis isn't the issue; it's relatively easy to safely share some ring buffers. The issue was/is that io_uring is rapidly growing the equivalent of ~all historical Linux syscall interfaces and sometimes comparable security measures were missed on the new interfaces. (Also, stuff like seccomp filters on syscalls are kind of meaningless for io_uring.)
- duped 1y ago...don't you supply the memory in the submission queue? or do you mean the queues themselves?
- LAC-Tech 1y agoThe memory for the submission queue is mmapd into user space. Easiest implementation to read is the Zig stdlib: https://github.com/ziglang/zig/blob/69cf40da600224734d39c6f64fb2e0905e42d54a/lib/std/os/linux/IoUring.zig#L1511 https://github.com/ziglang/zig/blob/69cf40da600224734d39c6f6...
- raesene9 1y agohttps://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html https://security.googleblog.com/2023/06/learnings-from-kctf-... - Has some interesting information on that topic.
- marcodiego 1y agoI updated the Wikipedia article on io_uring to dispute that.