Linux 6.1 Feature Would Have Caught All memcpy Based Buffer Overflows Of Recent Years

Written by Michael Larabel in Linux Security on 3 October 2022 at 01:30 PM EDT. 19 Comments
LINUX SECURITY --
A kernel hardening security improvement on the way for Linux 6.1 is the ability to provide warning of possible memcpy() based overflows. Right now this is only a warning but it's work towards being able to address "trivially detectable" buffer overflow conditions within the kernel and in the future may be able to block such overflows from happening.

The addition that's been in the works for over one year by Google engineer Kees Cook provides a run-time warning for cross-field memcpy() when the kernel is built with CONFIG_FORTIFY_SOURCE enabled. The feature provides run-time checking of dynamic memcpy() and memmove() lengths and will issue a warning when a write would exceed the size of the target struct member.

Kees Cook noted with the patch:
"This would have caught all of the memcpy()-based buffer overflows in the last 3 years, specifically covering all the cases where the destination buffer size is known at compile time."

The Linux "BleedingTooth" woes as the set of zero-click vulnerabilities within the Linux Bluetooth subsystem and leading to remote code execution is one example of something that could have been prevented by this work.


This fortification feature has made it through linux-next an entire cycle but there are still known cases of false positives. Until those false positives are properly resolved, this feature only provides a warning over such possible overflows but will not block them - it's possible once matured that such blocking will happen as a good defense against memcpy-based buffer overflows within the Linux kernel. The hope as well is even with the warning mode that this feature can be used for finding remaining issues within the kernel code where array sizes and struct members need to be fixed up, an ongoing focus in recent years.

More details within the kernel hardening pull request targeting the newly-opened Linux 6.1 merge window.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week