[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 17 Jan 2020 14:50:33 +0000
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Some AMD cpus with RDRAND fail to produce random
numbers after suspend/resume
> On 17 Jan 2020, at 08:10, Sven Schwedas <sven.schwedas@....at> wrote:
>
> On 17.01.20 05:21, Jeffrey Walton wrote:
>> I agree with Lennart Poettering. This seems CVE worthy given RDRAND is
>> often used to get the kernel generator (and other userland generators)
>> in good working order.
>
> From my understanding it's harmless as far as linux's kernel generator
> is concerned, as it's just xor'd to other entropy sources?
>
> CVEs should only be needed on a case-by-case basis for userland
> generators that aren't properly engineered.
Actually, the kernel does use rdrand directly for cases where a strong CPRNG not required. Whether some of those cases result in an exploitable bug I wouldn't like to say.
jch
Download attachment "signature.asc" of type "application/pgp-signature" (269 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
