What to do in response to a kernel warning [LWN.net]

What to do in response to a kernel warning

Posted Nov 18, 2021 22:19 UTC (Thu) by NYKevin (subscriber, #129325)
Parent article: What to do in response to a kernel warning

In the past, "I can make XScreenSaver crash by doing a weird thing" has been a CVE (because if XScreenSaver crashes, the screen unlocks). If someone could find a semi-reliable way to generate a kernel warning while a specific process is executing, then similar attacks might become possible under a pkill_on_warn policy.

Hopefully, the move to Wayland will obviate that specific instance of the problem, but in the more general case, how does the kernel know that it's safe to kill the currently executing process? You might be causing a security problem instead of remedying it.

to post comments

What to do in response to a kernel warning

Posted Nov 18, 2021 22:53 UTC (Thu) by a13xp0p0v (guest, #118926) [Link] (2 responses)

That is the right question.

In theory, the userspace should be adapted to this kernel behavior.

In practice, currently, the Linux kernel kills processes on oops. OOM killer kills processes. grsecurity also kills processes.

pkill_on_warn is simply stopping the process when the first signs of wrong behavior are detected. That complies with the Fail-Fast principle.
Bugs usually don't come alone, and a kernel warning may be followed by memory corruption or other negative effects. Real example:
https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
pkill_on_warn would prevent this kernel vulnerability exploit.

It would also make kernel warning infoleaks less valuable for the attacker. Exploit examples using such infoleaks:
https://googleprojectzero.blogspot.com/2018/09/a-cache-in...
https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html

Anyway, this patch provoked a deep discussion.
Maybe one day, the Linux kernel will get a more consistent error handling policy.

What to do in response to a kernel warning

Posted Nov 19, 2021 9:21 UTC (Fri) by geert (subscriber, #98403) [Link]

But it doesn't Fail-Fast if it kills the wrong thread. In general, there is no guarantee the bad state that caused the warning is limited to the thread(s) killed.

What to do in response to a kernel warning

Posted Nov 20, 2021 2:38 UTC (Sat) by NYKevin (subscriber, #129325) [Link]

> In practice, currently, the Linux kernel kills processes on oops. OOM killer kills processes. grsecurity also kills processes.

Well...

1. oops is pretty darned unusual, in my experience.
2. OOM killing is both unusual and at least tries* to target processes that might possibly be responsible for the OOM condition.
3. I have no idea about grsecurity, but it's not part of Linus's tree, so I frankly don't care what it does.

* There is a difference between trying and succeeding, of course.