mirror of
https://github.com/torvalds/linux
synced 2024-10-15 15:59:15 +00:00
binfmt_elf: Leave a gap between .bss and brk
Currently the brk starts its randomization immediately after .bss, which means there is a chance that when the random offset is 0, linear overflows from .bss can reach into the brk area. Leave at least a single page gap between .bss and brk (when it has not already been explicitly relocated into the mmap range). Reported-by: <y0un9n132@gmail.com> Closes: https://lore.kernel.org/linux-hardening/CA+2EKTVLvc8hDZc+2Yhwmus=dzOUG5E4gV7ayCbu0MPJTZzWkw@mail.gmail.com/ Link: https://lore.kernel.org/r/20240217062545.1631668-2-keescook@chromium.org Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
parent
a9c3475dd6
commit
2a5eb99955
|
@ -1262,6 +1262,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
|
|||
if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
|
||||
elf_ex->e_type == ET_DYN && !interpreter) {
|
||||
mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
|
||||
} else {
|
||||
/* Otherwise leave a gap between .bss and brk. */
|
||||
mm->brk = mm->start_brk = mm->brk + PAGE_SIZE;
|
||||
}
|
||||
|
||||
mm->brk = mm->start_brk = arch_randomize_brk(mm);
|
||||
|
|
Loading…
Reference in a new issue