Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 22 Sep 2015 10:42:11 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Samsung S4 (GT-I9500) multiple kernel
 vulnerabilities

On 09/21/2015 08:45 PM, Daniel Micay wrote:
>> CVE-2015-1800 is prevented by the STRUCTLEAK GCC plugin.
> 
> So I'm wrong about this part, as pipacs pointed out the __user marking
> is missing here, so it won't memset it in this case.
> 
> The missing __user would be found by upstream's sparse tool or the PaX
> checker plugin though.
> 
> The STRUCTLEAK plugin could also be extended to zero based on the
> copy_*_user calls, but that's probably not very useful since the missing
> __user markings could just be found via the existing tooling and fixed.

Did you measure the performance impact of initializing *all* local
variables to zero?  If the variable is not addressible (that is, if it
is an SSA_NAME), this is essentially free.

In our testing, we only saw a performance loss in socket address
handling, where a large placeholder struct is allocated, and the
performance loss is quite noticeable when processing small packets.
Unfortunately, this is were information disclosure happens in the past,
so excluding this very spot for performance reasons is not very satisfying.

The GCC patch we used is here:

<https://gcc.gnu.org/ml/gcc-patches/2014-06/msg00615.html>

-- 
Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ