Jump to content

Supervisor Mode Access Prevention

Edit links
From Wikipedia, the free encyclopedia

Supervisor Mode Access Prevention(SMAP) is a feature of someCPUimplementations such as theIntelBroadwellmicroarchitecture that allowssupervisor modeprograms to optionally setuser-spacememory mappingsso that access to those mappings from supervisor mode will cause a trap. This makes it harder formalicious programsto "trick" the kernel into usinginstructionsordatafrom a user-space program.[1][2]

History[edit]

Supervisor Mode Access Prevention is designed to complementSupervisor Mode Execution Prevention(SMEP), which was introduced earlier. SMEP can be used to prevent supervisor mode from unintentionally executing user-space code. SMAP extends this protection to reads and writes.[2]

Benefits[edit]

Without Supervisor Mode Access Prevention, supervisor code usually has full read and write access to user-space memory mappings (or has the ability to obtain full access). This has led to the development of several security exploits, includingprivilege escalationexploits, which operate by causing the kernel to access user-space memory when it did not intend to.[3]Operating systems can block these exploits by using SMAP to force unintended user-space memory accesses to triggerpage faults.Additionally, SMAP can expose flawed kernel code which does not follow the intended procedures for accessing user-space memory.[1]

However, the use of SMAP in an operating system may lead to a larger kernel size and slower user-space memory accesses from supervisor code, because SMAP must be temporarily disabled any time supervisor code intends to access user-space memory.[4]

Technical details[edit]

Processors indicate support for Supervisor Mode Access Prevention through theExtended Features CPUID leaf.

SMAP is enabled whenmemory pagingis active and the SMAP bit in theCR4 control registeris set. SMAP can be temporarily disabled for explicit memory accesses by setting theEFLAGS.AC(Alignment Check) flag. Thestac(Set AC Flag) andclac(Clear AC Flag) instructions can be used to easily set or clear the flag.[5]

When the SMAP bit in CR4 is set, explicit memory reads and writes to user-mode pages performed by code running with aprivilege levelless than 3 will always result in a page fault if the EFLAGS.AC flag is not set. Implicit reads and writes (such as those made todescriptor tables) to user-mode pages will always trigger a page fault if SMAP is enabled, regardless of the value of EFLAGS.AC.[5]

Operating system support[edit]

Linux kernelsupport for Supervisor Mode Access Prevention was implemented byH. Peter Anvin.[1]It was merged into the mainline Linux 3.7 kernel (released December 2012) and it is enabled by default for processors which support the feature.[4]

FreeBSDhas supported Supervisor Mode Execution Prevention since 2012[6]and Supervisor Mode Access Prevention since 2018.[7]

OpenBSDhas supported Supervisor Mode Access Prevention and the related Supervisor Mode Execution Prevention since 2012,[8]with OpenBSD 5.3 being the first release with support for the feature enabled.[9]

NetBSDsupport for Supervisor Mode Execution Prevention (SMEP) was implemented by Maxime Villard in December 2015.[10]Support for Supervisor Mode Access Prevention (SMAP) was also implemented by Maxime Villard, in August 2017.[11]NetBSD 8.0 was the first release with both features supported and enabled.[12]

Haikusupport for Supervisor Mode Execution Prevention (SMEP) was implemented by Jérôme Duval in January 2018.[13]

macOShas support for SMAP at least since macOS 10.13 released 2017.[14]

See also[edit]

References[edit]

  1. ^abcCorbet, Jonathan (2012-09-26)."Supervisor mode access prevention".LWN.net.Retrieved2017-08-04.
  2. ^abMulnix, David (2015-05-22)."Intel Xeon Processor D Product Family Technical Overview: Supervisor Mode Access Protection (SMAP) 4".Intel.Retrieved2017-08-04.
  3. ^Corbet, Jonathan (2009-07-20)."Fun with NULL pointers, part 1".LWN.net.Retrieved2017-08-04.
  4. ^abLarabel, Michael (2012-10-02)."Intel SMAP Comes To Try To Better Secure Linux".Phoronix.Retrieved2017-08-04.
  5. ^ab"Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A: System Programming Guide, Part 1"(PDF).Intel. July 2017.Retrieved2017-08-04.
  6. ^Belousov, Konstantin (2012-11-01)."Revision 242433".Retrieved2018-01-19.
  7. ^Belousov, Konstantin (2018-07-29)."Revision 336876".Retrieved2018-07-30.
  8. ^Henderson, Stuart (2017-03-26)."Re: Does OpenBSD have SMEP and SMAP implementation? or MPX?".Retrieved2017-08-04– viamarc.info.
  9. ^"OpenBSD 5.3".OpenBSD.2013-05-01.Retrieved2017-08-04.
  10. ^"Significant changes from NetBSD 7.0 to 8.0".NetBSD.2017-10-12.Retrieved2018-01-09.
  11. ^Maxime Villard (2017-08-23)."amd64: smap support".Retrieved2018-01-09.
  12. ^"Announcing NetBSD 8.0 (July 17, 2018)".NetBSD.2018-07-17.Retrieved2018-07-29.
  13. ^"kernel: support for Intel SMAP and SMEP on x86_64".Haiku (operating system).2018-01-30.Retrieved2018-09-04.
  14. ^"/osfmk/x86_64/idt64.s.auto.html".Apple Inc.2017-09-25.Retrieved2018-09-19.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Supervisor_Mode_Access_Prevention&oldid=1183627345"