Re: [Xen-devel] [PATCH 3/7] x86/mm: Further restrict permissions on some virtual mappings

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 02.05.17 at 20:05, <andrew.cooper3@xxxxxxxxxx> wrote:
> As originally reported, the Linear Pagetable slot maps 512GB of ram as RWX,
> where the guest has full read access and a lot of direct or indirect control
> over the written content.  It isn't hard for a PV guest to hide shellcode
> here.
> 
> Therefore, increase defence in depth by auditing our current pagetable
> mappings.
> 
>  * The regular linear, shadow linear, and per-domain slots have no business
>    being executable (but need to be written), so are updated to be NX.
>  * The Read Only mappings of the M2P (compat and regular) don't need to be
>    writeable or executable.
>  * The PV GDT mappings don't need to be executable.
> 
> Reported-by: Jann Horn <jannh@xxxxxxxxxx>
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
with two remarks:

> --- a/xen/arch/x86/mm.c
> +++ b/xen/arch/x86/mm.c
> @@ -384,7 +384,7 @@ void __init arch_init_memory(void)
>                      for ( ; i < L3_PAGETABLE_ENTRIES; ++i )
>                          l3tab[i] = l3e_empty();
>                      split_l4e = l4e_from_pfn(virt_to_mfn(l3tab),
> -                                             __PAGE_HYPERVISOR);
> +                                             __PAGE_HYPERVISOR_RW);

Would be nice if this change (affecting the direct map) was also
mentioned in the commit message, even if it's only debugging
code.

> @@ -515,7 +515,7 @@ void __init paging_init(void)
>              l3_ro_mpt = page_to_virt(l3_pg);
>              clear_page(l3_ro_mpt);
>              l4e_write(&idle_pg_table[l4_table_offset(va)],
> -                      l4e_from_page(l3_pg, __PAGE_HYPERVISOR));
> +                      l4e_from_page(l3_pg, __PAGE_HYPERVISOR_RW));

Similarly here (again affecting the direct map).

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel