CT_01_006 - Stack Clash Support (LLVM)
- Jeff Law
- Craig Topper
About
Stack clash is an exploit which utilized large frame allocations to "jump the guard page" creating a scenario where the heap and stack collided under attacker control. This can be used to gain full control of a vulnerable application. Stack probing techniques can be used to mitigate the vast majority of vulnerabilities in this space, but implementing them requires significant work for each and every target to be supported.
Stack clash mitigations are a soft requirement for distributions such as Fedora and a hard requirement for Red Hat Enterprise Linux.
Plan is to start with a naive implementation that probes at the start of each function allocating stack space and each page beyond the first which gets allocated. Once naive probing works we'll go back and adjust for probing of the outgoing argument space per the ABI requirements. Once probing of the outgoing argument space is functional we can remove the explicit probe at the start of each function and only start probing with the function allocates PAGE_SIZE-1k or more of stack space.
Red Hat has agreed to make their annocheck code available which was used to test the stack clash mitigations on x86. We'll evaluate if that can be repurposed for RISC-V. If so, great, otherwise we'll do a by-hand scanner (which will probably be too fragile/ugly to release). The goal is to scan every executable and dynamic object available in a distro such as Canonical, Debian, Fedora and flag any sequences that look like they may violate the requirements for stack clash mitigation. Even the best scanners have had false positives, so we'll evaluate the output of whatever scanner tool we choose.
It is expected that this work will begin once Raphael has completed the GCC implementation.
Stakeholders/Partners
RISE:
Ventana: Raphael Zinsly, lead developer.
Ventana: Jeff Law, oversight
Red Hat: Nick Clifton (provided the old x86 scanner tool)
External:
Dependencies
Status
Updates
- Raphael will be opening an MR imminently to start external review of the stack clash implementation
- Development work is complete
- Raphael is working on another project for Ventana, so can't focus on upstreaming
- Craig recommends posting it anyway for review
- Moved to 2H2024
- Basic work is considered complete
- Currently porting tests from other architectures to work on RISC-V, fixing bugs that exposes
- Hoping to start external review in the summer.
- Basic generation of probes is working in LLVM
- Currently working on getting call-frame-information updated properly
- After CFI fixes, need to add support for variable frames due to vector saves/restores
- Raphael just getting started on an LLVM implementation
- Project reported as priority for 1H2024.