net: netdev name hash leaks kernel text base
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest1 patch 3 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/1 | net: use random salt for netdev name hash to prevent text base leaknet/ | +5 | 2 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH net 0/1] net: netdev name hash leaks kernel text base
Hi,
An unprivileged user can recover the kernel text base and defeat KASLR by timing SIOCGIFINDEX lookups for attacker-chosen nonexistent interface names. These lookups reach dev_get_by_name_rcu() and fail with ENODEV without requiring capabilities or changes to network devices.
dev_name_hash() passes the struct net pointer to full_name_hash() as its salt. A missing name that hashes to the same bucket as a resident name, such as "lo", requires an extra chain traversal and takes measurably longer to look up. For a known kernel image, the collision pattern across possible KASLR slides identifies the runtime address of init_net and thus the kernel text base.
I reproduced the issue as an unprivileged user on x86-64 and arm64. A tested reproducer is available privately to maintainers on request.
Zhengchuan Liang (1):
net: use random salt for netdev name hash to prevent text base leak
net/core/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
Signature · 1 line
2.25.1