[oss-security] Lots of bugs in 32-bit x86 Linux entry code

From: Andy Lutomirski <luto-AT-kernel.org> To: oss security list <oss-security-AT-lists.openwall.com> Subject: [oss-security] Lots of bugs in 32-bit x86 Linux entry code Date: Mon, 25 Nov 2019 08:05:12 -0800 Message-ID: <CALCETrW1z0gCLFJz-1Jwj_wcT3+axXkP_wOCxY8JkbSLzV80GA@mail.gmail.com>

It turns out that there are essentially no upstream development resources dedicated to x86_32 Linux. Perhaps unsurprisingly, it was badly broken. I’m not even going to try to enumerate individual bugs here. I’m guessing that at least all x86_32 kernels that support PTI are vulnerable to privilege escalation via a series of ESPFIX bugs, but the missing segment override issue could go back years. Getting a nice printout on a double fault instead of a reboot, hang or memory corruption is dubious with PTI, and it’s also busted if you have this newfangled thing called “SMP” enabled. The relevant tests to run are tools/testing/selftests/x86/sigreturn_32 (from an updated kernel) and the same test with perf record -e cycles -F 10000. The bugs are hopefully mostly fixed in a pull request here: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.g... I strongly suspect that there is at least one bug left. You can mitigate these issues by upgrading to an x86_64 kernel. You can probably get a decent degree of mitigation by setting CONFIG_VM86=n and CONFIG_X86_16BIT=n. (CONFIG_X86_16BIT should be fine on a 64-bit kernel. Long live Wine.) To those of you who actually support x86_32: please either consider stopping supporting it or finding and paying someone to give it serious upstream attention. We need real CI resources and we need developers to test things for real, fix what’s broken, and generally keep it up to date. And the developers in question should have an appropriate degree of nostalgic adoration of segments, gates, and other delights from the i386 era.