Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 May 2017 08:56:19 +0200
From: Ingo Molnar <>
To: Kees Cook <>
Cc: Daniel Micay <>,
	Thomas Garnier <>,
	Martin Schwidefsky <>,
	Heiko Carstens <>,
	Dave Hansen <>, Arnd Bergmann <>,
	Thomas Gleixner <>,
	David Howells <>,
	René Nyffenegger <>,
	Andrew Morton <>,
	"Paul E . McKenney" <>,
	"Eric W . Biederman" <>,
	Oleg Nesterov <>,
	Pavel Tikhomirov <>,
	Ingo Molnar <>, "H . Peter Anvin" <>,
	Andy Lutomirski <>,
	Paolo Bonzini <>, Rik van Riel <>,
	Josh Poimboeuf <>,
	Borislav Petkov <>, Brian Gerst <>,
	"Kirill A . Shutemov" <>,
	Christian Borntraeger <>,
	Russell King <>,
	Will Deacon <>,
	Catalin Marinas <>,
	Mark Rutland <>,
	James Morse <>,
	linux-s390 <>,
	LKML <>,
	Linux API <>,
	the arch/x86 maintainers <>,
	"" <>,
	Kernel Hardening <>,
	Linus Torvalds <>,
	Peter Zijlstra <>,
	Al Viro <>
Subject: Re: Re: [PATCH v9 1/4] syscalls: Verify address
 limit before returning to user-mode

* Kees Cook <> wrote:

> > There's the option of using GCC plugins now that the infrastructure was 
> > upstreamed from grsecurity. It can be used as part of the regular build 
> > process and as long as the analysis is pretty simple it shouldn't hurt compile 
> > time much.
> Well, and that the situation may arise due to memory corruption, not from 
> poorly-matched set_fs() calls, which static analysis won't help solve. We need 
> to catch this bad kernel state because it is a very bad state to run in.

If memory corruption corrupted the task state into having addr_limit set to 
KERNEL_DS then there's already a fair chance that it's game over: it could also 
have set *uid to 0, or changed a sensitive PF_ flag, or a number of other 

Furthermore, think about it: there's literally an infinite amount of corrupted 
task states that could be a security problem and that could be checked after every 
system call. Do we want to check every one of them?



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.