linux-kernel - Re: [PATCH v2 10/10] binfmt_flat: allow compressed flat binary format to work on MMU systems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 Jul 2016 12:47:07 +0100
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	Nicolas Pitre <nicolas.pitre@...aro.org>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Alexander Viro <viro@...iv.linux.org.uk>,
	David Howells <dhowells@...hat.com>,
	Greg Ungerer <gerg@...ux-m68k.org>
Subject: Re: [PATCH v2 10/10] binfmt_flat: allow compressed flat binary
 format to work on MMU systems

On Sun, 17 Jul 2016 23:31:56 -0400
Nicolas Pitre <nicolas.pitre@...aro.org> wrote:

> Let's take the simple and obvious approach by decompressing the binary
> into a kernel buffer and then copying it to user space.  Those who are
> looking for more performance on a MMU system are unlikely to choose this
> executable format anyway.

The flat loader takes a very casual attitude to overruns and corrupted
binaries. It's after all MMUless so has no real security model. If you
enable flat for an MMU system then IMHO those all need to be fixed
including all the missing overflow checks on the maths on textlen and the
like.