Restrict userfaultfd
An ordinary program can no longer use the kernel side of this interface, which attackers have used to time their moves precisely. Programs that handle their own memory in user space still work.
Why it matters
The userfaultfd system call lets a program handle page faults itself. Attackers have used it to pause the kernel at an exact moment, widening a tiny timing gap enough to win a race in a bug such as a use-after-free. Taking away the kernel-mode form of this call from ordinary users makes many such bugs harder to exploit.
How it works
Sets vm.unprivileged_userfaultfd to 0. According to the kernel documentation, users without CAP_SYS_PTRACE can then only use userfaultfd for faults that happen in user mode, by passing the UFFD_USER_MODE_ONLY flag. Access through /dev/userfaultfd can be granted separately.
Who should use it
Fine for nearly every desktop and server. Review it if you run virtual machine live migration, checkpoint and restore tools, or other software built around userfaultfd.
What you may notice
Almost never visible. Software that needs full userfaultfd as a normal user may fail with a permission error until it is given /dev/userfaultfd or run with more rights.
Check it on your computer
Read the current value:
sysctl vm.unprivileged_userfaultfdApply it by hand
Set it now (until the next restart):
sudo sysctl -w vm.unprivileged_userfaultfd=0Keep it after restarts, in a file you own:
sudo tee /etc/sysctl.d/90-kernel-userfaultfd.conf <<'EOF'
vm.unprivileged_userfaultfd = 0
EOF
sudo sysctl --systemUndo it
Remove the file and restart, or set the old value back with sysctl -w.
Related settings
Sources
- Linux Hardening Guide (madaidans)
- 2.2.1