linux-kernel - Re: [PATCH] [57/99] exec: delay address limit change until point of no return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 28 Jul 2011 19:27:06 +0000
From:	halfdog <me@...fdog.net>
To:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Andi Kleen <andi@...stfloor.org>
Subject: Re: [PATCH] [57/99] exec: delay address limit change until point
 of no return

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This should be continuation of http://lkml.org/lkml/2011/7/27/488

Andi Kleen wrote:
> On Thu, Jul 28, 2011 at 07:52:57AM +0000, halfdog wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>> Hello Mr. Kleen,
>> 
>> I saw your posting on lkml. Currently, I have no deep enough 
>> understanding of kernel memory management, so do you think, that 
>> delaying could make a otherwise irrelevant timerace in exec arg
>> handling somehow problematic?
> 
> I guess it would be better to fix it. Can you post your analysis to
> linux-kernel@...r.kernel.org ?  Feel free to cc me.

Please see
https://bugzilla.kernel.org/show_bug.cgi?id=39222
for analysis (Timerace in sys_execve when copying argv/env data from
userspace)

Seems to be historic, but not critical timerace (POC available, but no
crash, mem-leaks, ..).

- From my opinion, it should be possible to make the argv ptr go over the
0xc0000000 kernel/user split on x86 architectures, but I do not know if
the patch in discussion would worsen the situation. Until now, I failed
to trouble the kernel using this.

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFOMbgIxFmThv7tq+4RAqckAJoCeYCAdrxzWk4UXWtklubfvGR1RwCeMG+J
Yj6zC0mawHkthGGA3kEPEa4=
=SLlm
-----END PGP SIGNATURE-----
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/