Pagemap: security fixes vs. ABI compatibility [LWN.net]

Pagemap: security fixes vs. ABI compatibility

Posted May 9, 2015 23:44 UTC (Sat) by alkbyby (subscriber, #61687)
Parent article: Pagemap: security fixes vs. ABI compatibility

IMHO this is very sad.

On one side we have very dubious _hardware_ bug that can be potentially used as vulnerability. And on the other side we have ABI-breakage that actually breaks product of people's hard work.

There are also likely other means to get physically contiguous pages. I.e. via huge pages or 1 gig pages. Also it's quite possible that on freshly booted system kernel already hands pages to processes in reasonably predictable way.

Maybe I'm missing something but, I can't see how rowhammer can be good reason for breaking people's code.

Also soft-dirty is nice, but sadly it can't be used by more than single entity at same time. I.e. if CRIU is using it, then it cannot be used for e.g. boehm gc for efficient tracking of mutations for generational GC and it cannot be used by UndoDB. I know it's a bit unrelated and it's likely that something more powerful and generic would be too inefficient, but it still adds to my sadness :(

P.S. I don't work for UndoDB. I just find this situation sad and unjust.

to post comments

Pagemap: security fixes vs. ABI compatibility

Posted May 11, 2015 12:23 UTC (Mon) by MarkWilliamsonAtUndo (guest, #102313) [Link]

Fortunately, from our PoV, whilst the change breaks our preferred operating mode we can use our fallback on the kernels that have this behaviour. If our patching work is accepted then hopefully it won't present overly widespread problems for us.

In terms of rowhammer, it's an interesting point about hugepages - presumably as there aren't as many of them you're much more likely to get one that's contiguous with something you'd like to meddle with.

More generally, my understanding is that hiding PFNs is explicitly intended as an obstacle to slow attackers rather than an outright fix. I can also see the argument that exposing PFNs in the first place was probably not the best plan, in hindsight...

Pagemap: security fixes vs. ABI compatibility

Posted May 11, 2015 15:08 UTC (Mon) by nix (subscriber, #2304) [Link]

On one side we have very dubious _hardware_ bug that can be potentially used as vulnerability.

I think 'has actually been used as a vulnerability' would be a better way of putting this, given that exploits have been demonstrated, and that the physical pfn info provided by pagemap is essential to escalate this from a DoS that crashes things at random to an exploit that lets you futz with the guts of the kernel to such an extent that you can execute arbitrary code in kernel space.