[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 19 Jun 2017 18:48:36 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: Qualys Security Advisory <qsa@...lys.com>
Subject: Re: Qualys Security Advisory - The Stack Clash
On Mon, Jun 19, 2017 at 12:46:20PM -0400, Daniel Micay wrote:
> On Mon, 2017-06-19 at 09:40 -0600, kseifried@...hat.com wrote:
> > On 06/19/2017 09:28 AM, Qualys Security Advisory wrote:
> > >
> > > Qualys Security Advisory
> > >
> > > The Stack Clash
> >
> > I just want to publicly thank Qualys for working with the Open Source
> > community so we (Linux and *BSD) could all get this fixed properly.
> > There was a lot of work from everyone involved and it all went pretty
> > smoothly.
>
> Fixing it properly would really also include fixing these:
>
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68065
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66479
>
> and actually implementing -fstack-check as not just a no-op in Clang.
>
> Windows has working stack probes, even in Windows XP and perhaps even
> earlier. LLVM has working stack probes there (not sure if GCC deals with
> it properly) yet doesn't make them available elsewhere.
>
> Rust is 'memory safe' but has this same stack exhaustion issue. It
> didn't used to have the issue, since it kept around the LLVM segmented
> stack code generation after it dropped segmented stacks to check for
> stack overflow in function preludes. That got dropped for a 1-3%
> performance win from using stack probes instead... which was a good
> idea, but without implementing stack probes... making it a terrible
> idea. It was deferred to some later date. That was in July 2015, and 2
> years later it's not done.
The GCC team at least has been working on patches on this topic and they will also
continue to work on this publically soon.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
