fix(security): extend /proc read block to maps siblings + auxv + pagemap - #56219
Merged
Conversation
…aps, mem PR #4609 blocked /proc/*/maps to prevent ASLR layout leakage, but the endswith("/maps") check does not match /proc/*/smaps or /proc/*/smaps_rollup — both expose the same virtual-address layout and bypass the guard. /proc/*/numa_maps carries the same data with NUMA annotations and is equally bypassed. /proc/*/mem (raw process memory) is added as defence-in-depth; it requires address knowledge to exploit but is blocked for consistency. Extends the endswith tuple in _is_blocked_device_path() to cover all four variants and adds regression assertions for all new paths to test_proc_sensitive_pseudo_files_blocked. Partially addresses #4427.
auxv leaks AT_RANDOM (stack canary seed) + AT_BASE/AT_PHDR load addresses — an ASLR oracle on par with maps. pagemap exposes virtual->physical translation. Both slipped through the endswith tuple alongside the maps family covered by the salvaged commit. Adds regression coverage for auxv/pagemap and for the per-thread /proc/<pid>/task/<tid>/<file> alias form (endswith catches both). Follow-up on #32238, closes #34430.
alt-glitch
added
type/security
Collaborator
4 tasks
19 tasks
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
read_filenow blocks six more/proc/*pseudo-files that leaked the same ASLR layout/proc/*/mapswas hidden to protect (PR #4609). Previously_is_blocked_device_path()only matchedendswith(("/environ", "/cmdline", "/maps")), so every sibling below slipped through./proc/*/smaps/proc/*/smaps_rollup/proc/*/numa_maps/proc/*/mem/proc/*/auxv/proc/*/pagemapread_file("/proc/self/smaps")or/proc/self/auxvrecovered the exact address layout #4609 set out to hide.Changes
tools/file_tools.py: extend theendswithtuple in_is_blocked_device_path()to cover smaps / smaps_rollup / numa_maps / mem (@AhmetArif0's commit) plus auxv / pagemap.endswithmatches both/proc/<pid>/Xand the per-thread/proc/<pid>/task/<tid>/Xalias.tests/tools/test_file_read_guards.py: regression assertions for all six new paths + a new test for the/proc/<pid>/task/<tid>/*thread-alias form.Same suffix-tuple pattern as #4609. A regex/set refactor across the full
/procleak surface (stack, syscall, wchan, kallsyms, …) is a worthwhile follow-up but out of scope for closing this immediate gap.Validation
/proc/self/{smaps,smaps_rollup,numa_maps,mem,auxv,pagemap}/proc/self/task/<tid>/{maps,auxv,pagemap,…}/proc/{cpuinfo,meminfo,version,uptime,status}tests/tools/test_file_read_guards.py: 43/43 pass.HERMES_HOME: all 10 sensitive paths refused at both the_is_blocked_deviceguard and theread_filesurface; all 5 legit/procpaths still readable.Salvage of #32238 (@AhmetArif0, commit cherry-picked with authorship preserved). Closes #34430, closes #32238.
Infographic