Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode
The Linux kernel has a security vulnerability that allows legacy I/O and memory interfaces to remain open in lockdown mode, allowing root users to write arbitrary I/O ports and map legacy I/O and memory spaces.
Intelligence analysis by Llama
A security vulnerability in the Linux kernel has been discovered, allowing legacy I/O and memory interfaces to remain open in lockdown mode. This allows root users to write arbitrary I/O ports and map legacy I/O and memory spaces.
Imagine you have a super-secure box that you want to keep safe from prying eyes. But, someone accidentally left a secret door open, allowing anyone to sneak in and mess with the box's insides. That's what happened with the Linux kernel, where a security vulnerability allowed someone to write arbitrary I/O ports and map legacy I/O and memory spaces, even when the kernel was in lockdown mode.
Analysis
Legacy I/O and Memory Interfaces in Kernel Lockdown Mode
The Linux kernel has a security vulnerability that allows legacy I/O and memory interfaces to remain open in lockdown mode. This means that root users can write arbitrary I/O ports and map legacy I/O and memory spaces, which is the same capability that the lockdown is meant to remove.
The legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down. This has been the case since 2019, when the code was originally added for locking down PCI BAR access when the kernel is in locked down mode.
A patch has been queued into the PCI subsystem's "next" Git branch ahead of Linux 7.3, which adds the necessary checks to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code. This patch is likely to get back-ported to existing stable Linux kernel versions as well.
Implications of the Vulnerability
The implications of this vulnerability are significant, as it allows malicious users to access sensitive kernel memory and modify the running kernel. This could potentially lead to a range of security issues, including kernel crashes and data corruption.
Fix and Backport
A fix for this vulnerability is on the way, with a patch queued into the PCI subsystem's "next" Git branch ahead of Linux 7.3. This patch adds the necessary checks to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code. It is likely that this patch will get back-ported to existing stable Linux kernel versions as well.
Key points
- The Linux kernel has a security vulnerability that allows legacy I/O and memory interfaces to remain open in lockdown mode.
- Root users can write arbitrary I/O ports and map legacy I/O and memory spaces, which is the same capability that the lockdown is meant to remove.
- A patch has been queued into the PCI subsystem's "next" Git branch ahead of Linux 7.3, which adds the necessary checks to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code.
- The fix is likely to get back-ported to existing stable Linux kernel versions as well.
The fix for this vulnerability is on the way, and it's likely to get back-ported to existing stable Linux kernel versions. This means that users can expect a secure and patched kernel in the near future.
The vulnerability has been present since 2019, and it's possible that malicious users may have exploited it before the fix was implemented. This could lead to a range of security issues, including kernel crashes and data corruption.