Open Bug 1441993 Opened 7 years ago Updated 3 years ago

Block priority-inheriting futexes in sandboxed processes if possible

Categories

(Core :: Security: Process Sandboxing, enhancement, P3)

Product:
Core
Component:
Security: Process Sandboxing
Platform:
Unspecified
Linux
Type:
enhancement

Tracking

()

People

(Reporter: jld, Unassigned)

References

Details

There have been security bugs in priority-inheriting futexes in the past, and I don't think we actually use them, so we should consider using seccomp-bpf to limit the exposed attack surface of futex().
Priority: -- → P3

More recently, some of the media people have discussed (ab)using priority-inheriting futexes to transfer realtime priority into a sandboxed process (because sandboxing needs to block DBus which prevents asking RTkit directly, and RTkit will grant realtime priority only to a thread in the process that actually made the request, and my understanding is that having realtime priority for threads handling audio data is empirically a noticeable improvement). So we might not want to do this; note that the kernel bug that inspired this bug was fixed many years ago.

There has been a new vulnerability exploiting PI futexes in the Linux kernel that allows non-root users to execute kernel-space code: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3347

Severity: minor → S4
You need to log in before you can comment on or make changes to this bug.