dirtycow / dirtycow.github.io

Dirty COW
https://dirtycow.ninja
3.35k stars 940 forks source link

was dirty cow a regression? #45

Closed kcc closed 7 years ago

kcc commented 7 years ago

I've heard that dirty cow is a regression: it was fixed in ~ 2005 but the fix was later reverted. Can you confirm (with a link)?

Thanks!

unixfox commented 7 years ago

Described here: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails#commit-messages

 commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
    Author: Linus Torvalds <torvalds@linux-foundation.org>
    Date:   Thu Oct 13 20:07:36 2016 GMT

    This is an ancient bug that was actually attempted to be fixed once
    (badly) by me eleven years ago in commit 4ceb5db9757a ("Fix
    get_user_pages() race for write access") but that was then undone due to
    problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").

    In the meantime, the s390 situation has long been fixed, and we can now
    fix it by checking the pte_dirty() bit properly (and do it better).  The
    s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement
    software dirty bits") which made it into v3.9.  Earlier kernels will
    have to look at the page state itself.

    Also, the VM has become more scalable, and what used a purely
    theoretical race back then has become easier to trigger.

    To fix it, we introduce a new internal FOLL_COW flag to mark the "yes,
    we already did a COW" rather than play racy games with FOLL_WRITE that
    is very fundamental, and then use the pte dirty flag to validate that
    the FOLL_COW flag is still valid.
kcc commented 7 years ago

Thanks!