bugtraq - Re: [ANNOUNCE] glibc heap protection patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <A26CD36A-25C7-11D8-8B1F-000A95675F0E@cs.ucsb.edu>
Date: Wed, 3 Dec 2003 11:33:56 -0800
From: William Robertson <wkr@...ucsb.edu>
To: "Eugene Tsyrklevich" <eugene@...urityarchitects.com>
Cc: sectools@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Re: [ANNOUNCE] glibc heap protection patch

On Dec 03, 2003, at 01:52, Eugene Tsyrklevich wrote:
> indeed, it should

This has been patched to use /dev/urandom in v1.4, which also fixes a 
couple of other issues.

> have you seen http://synflood.at/contrapolice/? your paper did not 
> mention
> this.

We didn't find this when we did our related work search back during 
late spring, but Andreas contacted me after our announcement.  From 
looking at the code, I don't think the goals are quite the same.  We 
only try to protect the chunk headers, but it seems that he wants 
instead to protect data contained in the user-visible memory region.  
This would be nice, but I think this has its own set of issues.

> any plans on porting this to OpenBSD (and saving me time :)?

I've started looking at it, but I don't think I'll have time to 
seriously evaluate the situation there for a week or two, so feel free. 
:-)

> eugene

--
William Robertson
Reliable Software Group, UC Santa Barbara
http://www.cs.ucsb.edu/~wkr/