On Fri, Dec 9, 2022 at 11:05 AM jeffxu@chromium.org wrote:
From: Jeff Xu jeffxu@google.com
Since Linux introduced the memfd feature, memfd have always had their execute bit set, and the memfd_create() syscall doesn't allow setting it differently.
However, in a secure by default system, such as ChromeOS, (where all executables should come from the rootfs, which is protected by Verified boot), this executable nature of memfd opens a door for NoExec bypass and enables “confused deputy attack”. E.g, in VRP bug [1]: cros_vm process created a memfd to share the content with an external process, however the memfd is overwritten and used for executing arbitrary code and root escalation. [2] lists more VRP in this kind.
...
Can you make this accessible so those of us on the public lists can view this bug? If not, please remove it from future postings and adjust your description accordingly.