Kees Cook, a former chief sysadmin of kernel.org and leader of the Ubuntu Security Team, currently working at Google to ensure the security of Android and ChromeOS, published a set of patches that implement stack offset randomization during system call processing. The patches enhance kernel security by modifying the stack placement, making stack attacks significantly more complex and less successful. The initial implementation supports ARM64 and x86/x86_64 processors.
The original idea for the patch belongs to the PaX RANDKSTACK project. In 2019, Elena Reshetova, an engineer from Intel, attempted to create an implementation of this idea suitable for inclusion in the mainline Linux kernel. Later, Kees Cook took up the initiative and presented an implementation suitable for the main version of the kernel. The patches are planned to be included in the release of version 5.13. The mode will be disabled by default. To enable it, the kernel command line parameter 'randomize_kstack_offset=on/off' and the CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT setting are proposed. The overhead when enabling the mode is estimated at approximately 1% performance loss.
The essence of the proposed protection lies in selecting a random stack offset for each system call, complicating the determination of the stack layout in memory, even if the addresses are obtained, as the base stack address will change with the next system call. Unlike the PaX RANDKSTACK implementation, in the proposed patches for inclusion in the kernel, randomization is performed not at the initial stage (cpu_current_top_of_stack), but after setting the pt_regs structure, making it impossible to use ptrace-based methods to determine the randomized offset during the execution of a long-running system call.
Forrás: opennet.ru
