Linux 6.1 Feature Would Have Caught All memcpy Based Buffer Overflows Of Recent Years

A kernel hardening security improvement on the way for Linux 6.1 is the ability to provide warning of possible memcpy() based overflows. Right now this is only a warning but it's work towards being able to address "trivially detectable" buffer overflow conditions within the kernel and in the future may be able to block such overflows from happening.

The addition that's been in the works for over one year by Google engineer Kees Cook provides a run-time warning for cross-field memcpy() when the kernel is built with CONFIG_FORTIFY_SOURCE enabled. The feature provides run-time checking of dynamic memcpy() and memmove() lengths and will issue a warning when a write would exceed the size of the target struct member.

Kees Cook noted with the patch:

"This would have caught all of the memcpy()-based buffer overflows in the last 3 years, specifically covering all the cases where the destination buffer size is known at compile time."

The Linux "BleedingTooth" woes as the set of zero-click vulnerabilities within the Linux Bluetooth subsystem and leading to remote code execution is one example of something that could have been prevented by this work.

This fortification feature has made it through linux-next an entire cycle but there are still known cases of false positives. Until those false positives are properly resolved, this feature only provides a warning over such possible overflows but will not block them - it's possible once matured that such blocking will happen as a good defense against memcpy-based buffer overflows within the Linux kernel. The hope as well is even with the warning mode that this feature can be used for finding remaining issues within the kernel code where array sizes and struct members need to be fixed up, an ongoing focus in recent years.

More details within the kernel hardening pull request targeting the newly-opened Linux 6.1 merge window.