Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 2 Nov 2017 11:11:10 -0700
From: Petr NejedlĂ˝ <pnejedly@...ckberry.com>
To: <kernel-hardening@...ts.openwall.com>
Subject: Re: Re: [PATCH V8 0/2] printk: hash addresses
 printed with %p

On 11/02/2017 09:04 AM, Sergey Senozhatsky wrote:
>>> hm... just a huge pile of if's
>>>
>>> 	if (is_vmalloc_addr(addr))
>>> 		do_hashing(addr);
>>> 	else if (__module_address(addr))
>>> 		do_hashing(addr);
>>> 	else if (is_kernel(addr) || is_kernel_inittext(addr))
>>> 	...
>>>
>>> but that's going to be really messy and "iffy".
>> This is the only suggestion we have so far.
>>
> well... one more: check if we can safely dereference it. if so
> it's a pointer, probably :)
>
> 	if (!probe_kernel_address(addr, p))
> 		do_hashing(addr);
None of that would fly - you'd open a side channel.
Just find a place where kernel prints userland provided value with %x
(quite easy I suppose) and check if it got hashed. A trivial and 
super-reliable
way to probe the kernel address space....

-- 
Petr

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.