Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 25 Oct 2016 07:57:52 +0000
From: "Reshetova, Elena" <elena.reshetova@...el.com>
To: Kees Cook <keescook@...omium.org>
CC: "kernel-hardening@...ts.openwall.com"
	<kernel-hardening@...ts.openwall.com>, Hans Liljestrand
	<ishkamiel@...il.com>, David Windsor <dwindsor@...il.com>
Subject: RE: [RFC v2 PATCH 01/13] Add architecture independent hardened
 atomic base

On Thu, Oct 20, 2016 at 3:25 AM, Elena Reshetova <elena.reshetova@...el.com> wrote:
> This series brings the PaX/Grsecurity PAX_REFCOUNT [1] feature support 
> to the upstream kernel. All credit for the feature goes to the feature 
> authors.
>
> The name of the upstream feature is HARDENED_ATOMIC and it is 
> configured using CONFIG_HARDENED_ATOMIC and HAVE_ARCH_HARDENED_ATOMIC.
>
> This series only adds x86 support; other architectures are expected to 
> add similar support gradually.
> [...]
> Bugs Prevented
> --------------
> HARDENED_ATOMIC would directly mitigate these Linux kernel bugs:
>
> CVE-2016-3135 - Netfilter xt_alloc_table_info integer overflow
> CVE-2010-2959 - CAN integer overflow vulnerability, related post: 
> https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overfl
> ow/

>These CVEs are "regular" integer overflows, rather than ref-counting flaws, so they should be left off the example list. (On kernsec.org, ref counting is a sub-set of integer overflow flaws, but the exploit examples are all merged together; Sorry for the > confusion!)

> CVE-2016-0728 - Keyring refcount overflow

>Exploit link is https://www.exploit-db.com/exploits/39277/

> CVE-2014-2851 - Group_info refcount overflow

>Exploit link is https://www.exploit-db.com/exploits/32926/

>
> And a relatively fresh exploit example:
> https://www.exploit-db.com/exploits/39773/

>For completeness, this is CVE-2016-4558.

I will fix all above! Thanks for pointing!

> [...]
>  Documentation/security/hardened-atomic.txt | 141 +++++++++++++++

>Nit on whitespace: I get warnings from git about trailing whitespace in this file.

David, would you be able to submit a fix for Documentation? You were planning to update the wording in it also, so I think this can be handled at the same time. 

Best Regards,
Elena.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.