{"id":99808,"date":"2021-04-15T10:22:45","date_gmt":"2021-04-15T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah"},"modified":"2021-04-15T10:22:45","modified_gmt":"2021-04-15T08:22:45","slug":"predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/predstavleny-patchi-dlya-randomizaczii-adresov-steka-yadra-linux-pri-sistemnyh-vyzovah","title":{"rendered":"Patches have been introduced for randomizing the stack addresses in the Linux kernel during system calls.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kees Cook, former chief sysadmin of kernel.org and leader of the Ubuntu Security Team, now working at Google on securing Android and ChromeOS, has published a set of patches implementing stack offset randomization in the kernel while handling system calls. The patches enhance kernel security by altering stack placement, making stack attacks significantly more difficult and less successful. The initial implementation supports ARM64 and x86\/x86_64 processors. <\/p>\n
The initial idea for the patch belongs to the PaX RANDKSTACK project. In 2019, Elena Reshetova, an engineer from Intel, attempted to create an implementation of this idea suitable for inclusion in the main part of the Linux kernel. Later, the initiative was taken up by Kees Cook, who presented an implementation compatible with the main version of the kernel. The patches are planned to be included in the 5.13 release. The mode will be disabled by default. To enable it, the kernel command line parameter \"randomize_kstack_offset=on\/off\" and the configuration option CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT are proposed. The overhead incurred by enabling the mode is estimated to be approximately a 1% performance loss. <\/p>\n
The essence of the proposed protection lies in selecting a random stack offset for each system call, complicating the determination of the stack layout in memory, even if data about addresses is obtained, as with the next system call, the base stack address will change. Unlike the PaX RANDKSTACK implementation, the proposed patches for inclusion in the kernel perform randomization not at the initial stage (cpu_current_top_of_stack) but after the pt_regs structure is set, making it impossible to use ptrace-based methods to determine the randomized offset during the execution of a long-running system call. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"