The Precise Pangolin has reached end of life, so this bug will not be
fixed for that release
** Changed in: linux (Ubuntu Precise)
Status: Triaged => Won't Fix
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1018415
Title:
Backport vsyscall=emulate behaviour to 12.04 LTS as exploit mitigation
measure
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Precise:
Won't Fix
Bug description:
vsyscall is an obsolete method (replaced by vdso) to do vast system calls.
Because it is part of the linux x86-64 ABI, it always has to be mapped to a
static address by the kernel.
This means that in the case of a vulnerability (in some user program),
an attacker making use of return oriented programming can rely on
useful gadgets at a known address (bypassing ASLR.) Using the gadgets
in vsyscall it is possible to get arbitrary code execution with only one
trivial extra gadget (or in some cases none at all.)
This is why recent kernels emulate the obsolete vsyscall ABI in-kernel.
The emulation makes sure that an attacker can only call functions defined by
the ABI, like gettimeofday(), and cannot, for example, directly jump to
a syscall & ret gadget. Only calls to offsets defined in the ABI are allowed.
In my opinion, backporting the new default behaviour of emulating vsyscall to
LTS would increase the time / effort / skill needed for exploit writers to
write a
successful exploit somewhat, and make the resulting exploits less generic.
Patch to change default behaviour:
https://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=2e57ae0515124af45dd889bfbd4840fd40fcc07d
It is already possible to specify the behaviour at boot time:
vsyscall=emulate
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1018415/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
