Kees Cook, former chief sysadmin of kernel.org and leader of the Ubuntu Security Team, now working at Google on securing Android and ChromeOS, has published a set of patches implementing stack offset randomization in the kernel while handling system calls. The patches enhance kernel security by altering stack placement, making stack attacks significantly more difficult and less successful. The initial implementation supports ARM64 and x86/x86_64 processors.
The original idea for the patch belongs to the PaX RANDKSTACK project. In 2019, Elena Reshetova, an engineer from Intel, attempted to create an implementation of this idea suitable for inclusion in the mainline Linux kernel. Later, Kees Cook took over the initiative and presented a version suitable for the main kernel variant. The patches are planned to be included in the 5.13 release. The mode will be disabled by default. To enable it, the kernel command line parameter "randomize_kstack_offset=on/off" and the CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT setting are proposed. The overhead incurred from enabling the mode is estimated at about a 1% performance loss.
The essence of the proposed protection lies in selecting a random stack offset for each system call, complicating the determination of the stack layout in memory, even if data about addresses is obtained, as with the next system call, the base stack address will change. Unlike the PaX RANDKSTACK implementation, the proposed patches for inclusion in the kernel perform randomization not at the initial stage (cpu_current_top_of_stack) but after the pt_regs structure is set, making it impossible to use ptrace-based methods to determine the randomized offset during the execution of a long-running system call.
Source: opennet.ru
