Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Jul 2017 08:43:19 -0500 (CDT)
From: Christoph Lameter <>
To: Kees Cook <>
cc: Andrew Morton <>, 
    Pekka Enberg <>, David Rientjes <>, 
    Joonsoo Kim <>, 
    "Paul E. McKenney" <>, 
    Ingo Molnar <>, Josh Triplett <>, 
    Andy Lutomirski <>, 
    Nicolas Pitre <>, Tejun Heo <>, 
    Daniel Mack <>, 
    Sebastian Andrzej Siewior <>, 
    Sergey Senozhatsky <>, 
    Helge Deller <>, Rik van Riel <>,, Tycho Andersen <>,,
Subject: Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation

On Wed, 5 Jul 2017, Kees Cook wrote:

> @@ -3536,6 +3565,9 @@ static int kmem_cache_open(struct kmem_cache *s, unsigned long flags)
>  {
>  	s->flags = kmem_cache_flags(s->size, flags, s->name, s->ctor);
>  	s->reserved = 0;
> +	s->random = get_random_long();
> +#endif
>  	if (need_reserve_slab_rcu && (s->flags & SLAB_TYPESAFE_BY_RCU))
>  		s->reserved = sizeof(struct rcu_head);

So if an attacker knows the internal structure of data then he can simply
dereference page->kmem_cache->random to decode the freepointer.

Assuming someone is already targeting a freelist pointer (which indicates
detailed knowledge of the internal structure) then I would think that
someone like that will also figure out how to follow the pointer links to
get to the random value.

Not seeing the point of all of this.

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.