From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 18623 invoked from network); 2 Dec 2020 01:37:24 -0000 Received: from mother.openwall.net (195.42.179.200) by inbox.vuxu.org with ESMTPUTF8; 2 Dec 2020 01:37:24 -0000 Received: (qmail 8039 invoked by uid 550); 2 Dec 2020 01:37:20 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 8020 invoked from network); 2 Dec 2020 01:37:19 -0000 Date: Tue, 1 Dec 2020 20:37:07 -0500 From: Rich Felker To: musl@lists.openwall.com Message-ID: <20201202013707.GU534@brightrain.aerifal.cx> References: <20201202005539.6418-1-ariadne@dereferenced.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20201202005539.6418-1-ariadne@dereferenced.org> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] [PATCH] harden against unauthorized writes to the atexit function lists On Tue, Dec 01, 2020 at 05:55:39PM -0700, Ariadne Conill wrote: > previously, the first atexit list block was stored in BSS, which means an > attacker could potentially ascertain its location and modify it, allowing > for its abuse as a code execution mechanism. > > by moving the atexit list into a series of anonymous mmaped pages, we can > use mprotect to protect the atexit lists by keeping them readonly when they > are not being mutated by the __cxa_atexit() function. This is a non-starter. atexit is specifically required by the standard to succeed when called no more than 32 times, which is why we have 32 built-in slots that always exist. If you really want to pursue something here it should probably just be protecting the pointers with some secret... Rich