595049 - nanojit: harden against writes to executable code pages

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Baseline JIT (CodegenLIR), defect)

Description

[Rick Reitmaier]

This attack relies on being able to overwrite code generated by the JIT during the period in which the memory protection bits have not yet transition to r-x (i.e. they are still rw-).

One approach to foiling this type of attack would be to compute a CRC value as instructions are written to the page, making the page r-x and then recomputing the CRC (based on page contents) to ensure that it has not deviated.

Another defense against this type of attack is to shrink the time that the code is vulnerable,  so setting page protections as each page is processed might be a valid approach.

Comment 1

[Rick Reitmaier]

Related and not discussed in the iSEC report, is bug 506693, which proposes that jit code pages be dual-mapped in the address space, with one mapping RW and the other mapping RX.

Comment 2

[Rick Reitmaier]

Attachment: wip - includes other mitigation techniques

work-in-progress patch that computes a CRC checksum for each method that has previously been generated and is on a executable page.

Prior to switching the pages to rw- we gather up these CRCs and later use them to re-validate the contents of each method on the page.

see code bordered by the define NJ_HARDENING_CODE_CRC

Comment 3

[Rick Reitmaier]

Related is bug 506693; dual mapping of code pages.

Comment 4

[Andre Kruetzfeldt]

Can we fold this bug into 506693?

Comment 5

[Rick Reitmaier]

(In reply to comment #4)
> Can we fold this bug into 506693?

Different techniques and the bugs are cross-listed so I don't see value in doing so.

Comment 6

[Andre Kruetzfeldt]

Rick, following your recent comments on hardening, please re-assign this bug to a doable target release. Removing Andre blocker.

Comment 7

[Rick Reitmaier]

I don't believe this should be assigned as its not yet proven this is a worthwhile deterrent.

Target is future and its unassigned.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 9

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.