Linux Internals: How /proc/self/mem writes to unwritable memory (2021)

Linux Internals: How /proc/self/mem writes to unwritable memory (2021)(offlinemark.com)

129 points by medbar 70 days ago | 29 comments

hansendc 70 days ago |

"On x86-64, there are two CPU settings which control the kernel’s ability to access memory."

There are a couple more than two, even in 2021.

Memory Protection Keys come to mind, as do the NPT/EPT tables when virtualization is in play. SEV and SGX also have their own ways of preventing the kernel from writing to memory. The CPU also has range registers that protect certain special physical address ranges, like the TDX module's range. You can't write there either.

That's all that comes to mind at the moment. It's definitely a fun question!

karlgkk 70 days ago | |

a thought: do MPK actually control the kernel's ability to access memory? on intel, i think if you try to read that memory, a page fault wont be thrown. although with PKS, kernel reads will cause a page fault.

so can the kernel (ring0) freely read/write to memory encrypted with MPK? I think so, yes. good luck with whatever happens next tho lol

als0 70 days ago | | |

There are two versions of MPK. One is only applicable to userspace pages. The other is newer and can be applied to kernel space pages; last time I checked, this was only available on newer Xeon processors.

By the way, MPK memory is not encrypted. The key is just an identifier for the requestor. If the requestor key doesn’t match the same identifier for the memory page, then an exception is raised.

Funnily enough, MPK isn’t new at all. It’s almost a reintroduction of a feature from Itanium.

KenoFischer 70 days ago |

I'm still surprised I was the first one to notice when Linus tried to change this - I always thought it was a pretty well known behavior.

aliceryhl 70 days ago |

Interesting. Though looking at the code, it does still check VM_MAYWRITE, so the mapping needs to be something you could remap as writable.

anthk 70 days ago |

/proc it's a bad imitation of plan9's /proc.

bluepeter 70 days ago |

The kernel owns the page tables. It can always find another way in.

mschuster91 70 days ago | |

> The kernel owns the page tables.

not entirely, IOMMU is a thing, that is IIRC how Amazon and other hyperscalers can promise you virtual machines whose memory cannot be touched even in the case the host is compromised (and, by extension, also if the feds arrive to v& your server).

gruez 70 days ago | | |

>how Amazon and other hyperscalers can promise you virtual machines whose memory cannot be touched even in the case the host is compromised (and, by extension, also if the feds arrive to v& your server).

Even if we take those promises at face value, it practically doesn't mean much because every server still needs to handle reboots, which is when they can inject their evil code.

ronsor 70 days ago | | |

If your threat model is being v& by feds, maybe you should keep your server at home behind Tor.

vlovich123 70 days ago | |

But the point here is that userspace can use this to bypass kernel protections that would otherwise prevent it from mutating R^X pages for example, not that the kernel can bypass its own.

im3w1l 70 days ago | | |

Those protections are mainly about preventing well intentioned people from accidentally shooting themselves in the foot though, right? So it's not really a big deal that there is a way around it.

pjmlp 70 days ago | |

Not really, of the security measures on Windows, is exactly to control how kernel can access secure process memory, as possible mitigation to attacks by rogue drivers.

Naturally it is the kind of stuff that requires Windows 11 vlatest with the nice Pluton security CPU, as part of CoPilot+ PCs design.

haberman 70 days ago |

TL;DR: when a user writes to /proc/self/mem, the kernel bypasses the MMU and hardware address translation, opting to emulate it in software (including emulated page faults!), which allows it to disregard any memory protection that is currently setup in the page tables.

IAmLiterallyAB 70 days ago | |

It doesn't bypass it exactly, it's still accessing it via virtual memory and the page tables. It's just that the kernel maintains one big linear memory map of RAM that's writable.

rramadass 70 days ago | |

Thank You.