code is freedom -- patching my itch
The Pixel 8 hardware (Tensor G3) supports the ARM Memory Tagging Extension (MTE), and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I m extremely happy to see this hardware finally available in the real world. [ ]
As part of the continuing work to replace 1-element arrays in the Linux kernel, it s very handy to show that a source change has had no executable code difference. For example, if you started with this: struct foo { unsigned long flags; u32 length; u32 data[1]; }; void foo_init(int count) { struct foo *instance; size_t [ ]
Previously: v5.9 Linux v5.10 was released in December, 2020. Here’s my summary of various security things that I found interesting: AMD SEV-ES While guest VM memory encryption with AMD SEV has been supported for a while, Joerg Roedel, Thomas Lendacky, and others added register state encryption (SEV-ES). This means it s even harder for a VM [ ]
Previously: v5.8 Linux v5.9 was released in October, 2020. Here’s my summary of various security things that I found interesting: seccomp user_notif file descriptor injection Sargun Dhillon added the ability for SECCOMP_RET_USER_NOTIF filters to inject file descriptors into the target process using SECCOMP_IOCTL_NOTIF_ADDFD. This lets container managers fully emulate syscalls like open() and…
Previously: v5.7 Linux v5.8 was released in August, 2020. Here’s my summary of various security things that caught my attention: arm64 Branch Target Identification Dave Martin added support for ARMv8.5 s Branch Target Instructions (BTI), which are enabled in userspace at execve() time, and all the time in the kernel (which required manually marking up a [ ]
I frequently see a pattern in image build/refresh scripts where a set of packages is installed, and then all packages are updated: apt update apt install -y pkg1 pkg2 pkg2 apt dist-upgrade -y While it s not much, this results in redundant work. For example reading/writing package database, potentially running triggers (man-page refresh, ldconfig, etc). The [ ]
Previously: v5.6 Linux v5.7 was released at the end of May. Here’s my summary of various security things that caught my attention: arm64 kernel pointer authentication While the ARMv8.3 CPU Pointer Authentication (PAC) feature landed for userspace already, Kristina Martsenko has now landed PAC support in kernel mode. The current implementation uses PACIASP which protects [ ]
Previously: v5.5. Linux v5.6 was released back in March. Here s my quick summary of various features that caught my attention: WireGuard The widely used WireGuard VPN has been out-of-tree for a very long time. After 3 1/2 years since its initial upstream RFC, Ard Biesheuvel and Jason Donenfeld finished the work getting all the crypto [ ]
Previously: v5.4. I got a bit behind on this blog post series! Let s get caught up. Here are a bunch of security things I found interesting in the Linux kernel v5.5 release: restrict perf_event_open() from LSM Given the recurring flaws in the perf subsystem, there has been a strong desire to be able to entirely [ ]
Previously: v5.3. Linux kernel v5.4 was released in late November. The holidays got the best of me, but better late than never! ;) Here are some security-related things I found interesting: waitid() gains P_PIDFD Christian Brauner has continued his pidfd work by adding a critical mode to waitid(): P_PIDFD. This makes it possible to reap [ ]
While much of the work on kernel Control Flow Integrity (CFI) is focused on arm64 (since kernel CFI is available on Android), a significant portion is in the core kernel itself (and especially the build system). Recently I got a sane build and boot on x86 with everything enabled, and I ve been picking through some [ ]
Previously: v5.2. Linux kernel v5.3 was released! I let this blog post get away from me, but it s up now! :) Here are some security-related things I found interesting: heap variable initialization In the continuing work to remove uninitialized variables from the kernel, Alexander Potapenko added new init_on_alloc and init_on_free boot parameters (with associated Kconfig [ ]
Previously: v5.1. Linux kernel v5.2 was released last week! Here are some security-related things I found interesting: page allocator freelist randomization While the SLUB and SLAB allocator freelists have been randomized for a while now, the overarching page allocator itself wasn t. This meant that anything doing allocation outside of the kmem_cache/kmalloc() would have deterministic placement […
Forever ago I set up tooling to generate graphs representing the adoption of various hardening features in Ubuntu packaging. These were very interesting in 2006 when stack protector was making its way into the package archive. Similarly in 2008 and 2009 as FORTIFY_SOURCE and read-only relocations made their way through the archive. It took a [ ]
Previously: v5.0. Linux kernel v5.1 has been released! Here are some security-related things that stood out to me: introduction of pidfd Christian Brauner landed the first portion of his work to remove pid races from the kernel: using a file descriptor to reference a process ( pidfd ). Now /proc/$pid can be opened and used as an [ ]
Previously: v4.20. Linux kernel v5.0 was released last week! Looking through the changes, here are some security-related things I found interesting: read-only linear mapping, arm64 While x86 has had a read-only linear mapping (or Low Kernel Mapping as shown in /sys/kernel/debug/page_tables/kernel under CONFIG_X86_PTDUMP=y) for a while, Ard Biesheuvel has added them to arm64 now. This [ ]
Previously: v4.19. Linux kernel v4.20 has been released today! Looking through the changes, here are some security-related things I found interesting: stackleak plugin Alexander Popov s work to port the grsecurity STACKLEAK plugin to the upstream kernel came to fruition. While it had received Acks from x86 (and arm64) maintainers, it has been rejected a few [ ]
Previously: v4.18. Linux kernel v4.19 was released today. Here are some security-related things I found interesting: L1 Terminal Fault (L1TF) While it seems like ages ago, the fixes for L1TF actually landed at the start of the v4.19 merge window. As with the other speculation flaw fixes, lots of people were involved, and the scope [ ]
Previously: v4.17. Linux kernel v4.18 was released last week. Here are details on some of the security things I found interesting: allocation overflow detection helpers One of the many ways C can be dangerous to use is that it lacks strong primitives to deal with arithmetic overflow. A developer can t just wrap a series of [ ]
Previously: v4.16. Linux kernel v4.17 was released last week, and here are some of the security things I think are interesting: Jailhouse hypervisor Jan Kiszka landed Jailhouse hypervisor support, which uses static partitioning (i.e. no resource over-committing), where the root cell spawns new jails by shrinking its own CPU/memory/etc resources and hands them over to [ ]
I spent some time yesterday building out a UEFI server that didn t have on-board hardware RAID for its system drives. In these situations, I always use Linux s md RAID1 for the root filesystem (and/or /boot). This worked well for BIOS booting since BIOS just transfers control blindly to the MBR of whatever disk it sees [ ]
Previously: v4.15.  Linux kernel v4.16 was released last week. I really should write these posts in advance, otherwise I get distracted by the merge window. Regardless, here are some of the security things I think are interesting: KPTI on arm64 Will Deacon, Catalin Marinas, and several other folks brought Kernel Page Table Isolation (via [ ]
Previously: v4.14. Linux kernel v4.15 was released last week, and there’s a bunch of security things I think are interesting: Kernel Page Table Isolation PTI has already gotten plenty of reporting, but to summarize, it is mainly to protect against CPU cache timing side-channel attacks that can expose kernel memory contents to userspace (CVE-2017-5754, the [ ]
An nice additional benefit of the recent Kernel Page Table Isolation (CONFIG_PAGE_TABLE_ISOLATION) patches (to defend against CVE-2017-5754, the speculative execution rogue data cache load or Meltdown flaw) is that the userspace page tables visible while running in kernel mode lack the executable bit. As a result, systems without the SMEP CPU feature (before Ivy-Bridge) get [ ]
Previously: v4.13. Linux kernel v4.14 was released this last Sunday, and there s a bunch of security things I think are interesting: vmapped kernel stack on arm64 Similar to the same feature on x86, Mark Rutland and Ard Biesheuvel implemented CONFIG_VMAP_STACK for arm64, which moves the kernel stack to an isolated and guard-paged vmap area. With [ ]
Previously: v4.12. Here s a short summary of some of interesting security things in Sunday s v4.13 release of the Linux kernel: security documentation ReSTification The kernel has been switching to formatting documentation with ReST, and I noticed that none of the Documentation/security/ tree had been converted yet. I took the opportunity to take a few passes [ ]
I got myself stuck yesterday with GRUB running from an ext4 /boot/grub, but with /boot inside my LUKS LVM root partition, which meant GRUB couldn t load the initramfs and kernel. Luckily, it turns out that GRUB does know how to mount LUKS volumes (and LVM volumes), but all the instructions I could find talk about [ ]
Previously: v4.11. Here’s a quick summary of some of the interesting security things in last week’s v4.12 release of the Linux kernel: x86 read-only and fixed-location GDT With kernel memory base randomization, it was stil possible to figure out the per-cpu base address via the sgdt instruction, since it would reveal the per-cpu GDT location. [ ]
Previously: v4.10. Here’s a quick summary of some of the interesting security things in this week’s v4.11 release of the Linux kernel: refcount_t infrastructure Building on the efforts of Elena Reshetova, Hans Liljestrand, and David Windsor to port PaX s PAX_REFCOUNT protection, Peter Zijlstra implemented a new kernel API for reference counting with the addition of [ ]
Previously: v4.9. Here s a quick summary of some of the interesting security things in last week s v4.10 release of the Linux kernel: PAN emulation on arm64 Catalin Marinas introduced ARM64_SW_TTBR0_PAN, which is functionally the arm64 equivalent of arm s CONFIG_CPU_SW_DOMAIN_PAN. While Privileged eXecute Never (PXN) has been available in ARM hardware for a while now, Privileged [ ]