Date: Tue, 30 Sep 2014 19:40:07 -0400 (EDT) From: "Stuart D. Gathman" <stuart@...hman.org> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: Healing the bash fork On Tue, 30 Sep 2014, David A. Wheeler wrote: > Finally: *PLEASE* let me know if you have any good ideas on how to > find vulnerabilities like this ahead-of-time. My article "How to > Prevent the Next Hearbleed" > (http://www.dwheeler.com/essays/heartbleed.html) lists a number of > ways that Heartbleed-like vulnerabilities could have been detected > ahead-of-time, in ways that are general enough to be useful. I'd like > to do the same with Shellshock, so we can quickly eliminate a whole > class of problems. I don't know if this can be made efficient enought to be practical, but imagine a virtual machine where every byte of memory is tagged with the security domain. When a byte is copied, the tag is copied also. (It is not possible in general to distinguish copies from writes, but at least when copying between domains via system calls, this is detectable.) Then, when a privileged program is running, its memory can be scanned for data from a lower privilege domain. I think this is optimizable, since most memory will have the same tag, and can be managed via virtual memory paging. Update on write logic will create a more detailed map for "hot" pages. Caveat: someone probably already did this, and I just never heard of it.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.