[PATCH net 0/1] net: netdev name hash leaks kernel text base

[Zhengchuan Liang]

Hi,

An unprivileged user can recover the kernel text base and defeat KASLR by
timing SIOCGIFINDEX lookups for attacker-chosen nonexistent interface
names. These lookups reach dev_get_by_name_rcu() and fail with ENODEV
without requiring capabilities or changes to network devices.

dev_name_hash() passes the struct net pointer to full_name_hash() as its
salt. A missing name that hashes to the same bucket as a resident name,
such as "lo", requires an extra chain traversal and takes measurably
longer to look up. For a known kernel image, the collision pattern across
possible KASLR slides identifies the runtime address of init_net and thus
the kernel text base.

I reproduced the issue as an unprivileged user on x86-64 and arm64.
A tested reproducer is available privately to maintainers on request.

Zhengchuan Liang (1):
  net: use random salt for netdev name hash to prevent text base leak

 net/core/dev.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

-- 
2.25.1