linux-kernel - Re: Linux doesn't follow x86/x86-64 ABI wrt direction flag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Mar 2008 09:34:38 -0800
From:	Joe Buck <Joe.Buck@...opsys.COM>
To:	Richard Guenther <richard.guenther@...il.com>
Cc:	Andi Kleen <andi@...stfloor.org>, Andrew Haley <aph@...hat.com>,
	Aurelien Jarno <aurelien@...el32.net>,
	"H. Peter Anvin" <hpa@...or.com>, Michael Matz <matz@...e.de>,
	linux-kernel@...r.kernel.org, gcc@....gnu.org
Subject: Re: Linux doesn't follow x86/x86-64 ABI wrt direction flag

On Thu, Mar 06, 2008 at 01:06:17PM +0100, Richard Guenther wrote:
> On 06 Mar 2008 12:45:57 +0100, Andi Kleen <andi@...stfloor.org> wrote:
> > Andrew Haley <aph@...hat.com> writes:
> >  >
> >  > I suppose one could apply the precautionary principle, but those systems that
> >  > don't update kernels won't update gcc either, so the solution won't work.
> >
> >  You seem to assume that running a gcc 4.3 compiled binary requires a
> >  gcc update. That is not necessarily true.
> 
> It (sometimes) requires a libgcc and libstdc++ update.

"Sometimes" is correct; many users commonly run newer compilers on older
distros, with LD_LIBRARY_PATH set to pick up the correct C++ support
library.  This is particularly common on servers, where you don't want to
mess with a working system but you might need to run newer code.

So, we've been arguing for a while, so the question is what to do.

Using a principle based on the old IETF concept of being liberal in what
you accept, and conservative in what you send, I think that both the Linux
kernel and gcc should fix the problem.  The kernel should fix the
information leak, and gcc should remove the assumption that the direction
flag is set in a given direction on function entry.

The gcc patch will be too late for 4.3.0, but it would be on the 4.3
branch, and we would recommend that distros pick it up for any compilers
they ship.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/