full-disclosure

Open Source and information security mailing list archives

Message-ID: <20150304023858.GP3530@chrisbox.seclab.ucsb.edu>
Date: Tue, 3 Mar 2015 18:38:58 -0800
From: Christophe Hauser <christophe@...ucsb.edu>
To: fulldisclosure@...lists.org
Subject: [FD] Partial pointer leaks

Hi everyone,

I am posting this message in the hope to gather suggestions about
potential past vulnerabilities of a specific kind (described below), or
ideas about applications, libraries or APIs that might potentially be
subject to it.

As part of an academic project, I am looking for examples of partial,
and eventually indirect pointer leaks in the wild. I am basically after
leaks that only reveal several bits (but not all) of an address (heap,
stack, function, anything). What I mean here by indirect is the fact
that the leaked information might not look like an address (or be an
address) by itself. It could for example be the result of some operation
(arithmetic or whatnot) on an address.

I am not looking for general information disclosure vulnerabilities such
as buffer over-reads (that may only be triggered by some specific out of
range parameters or input), but rather for pointer leaks as being the
result of manipulation errors, or "dangerous use of pointers", or
anything else resulting in data dependency between a pointer and an
output variable of any given application. If this description reminds
any past vulnerabilities to anyone, I would be very interested to hear
about it.

Otherwise, something that comes to mind is applications/APIs using
pointers or addresses (or anything deriving from them) as identifiers,
with or without obfuscation.  I read for example that INET_DIAG socket
API in the Linux kernel is (or at least was) actually using addresses as
handles[1]. Any other similar examples would be very interesting, both
in user-space and kernel-space.

[1] http://lwn.net/Articles/569635/ 

-- 
Christophe

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives