linux-kernel - Re: Linux doesn't follow x86/x86-64 ABI wrt direction flag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Mar 2008 21:54:38 +0100
From:	"Richard Guenther" <richard.guenther@...il.com>
To:	"Joe Buck" <Joe.Buck@...opsys.com>
Cc:	"Andi Kleen" <andi@...stfloor.org>,
	"Andrew Haley" <aph@...hat.com>,
	"Aurelien Jarno" <aurelien@...el32.net>,
	"H. Peter Anvin" <hpa@...or.com>, "Michael Matz" <matz@...e.de>,
	linux-kernel@...r.kernel.org, gcc@....gnu.org
Subject: Re: Linux doesn't follow x86/x86-64 ABI wrt direction flag

On Thu, Mar 6, 2008 at 6:34 PM, Joe Buck <Joe.Buck@...opsys.com> wrote:
>
> On Thu, Mar 06, 2008 at 01:06:17PM +0100, Richard Guenther wrote:
>  > On 06 Mar 2008 12:45:57 +0100, Andi Kleen <andi@...stfloor.org> wrote:
>  > > Andrew Haley <aph@...hat.com> writes:
>  > >  >
>  > >  > I suppose one could apply the precautionary principle, but those systems that
>  > >  > don't update kernels won't update gcc either, so the solution won't work.
>  > >
>  > >  You seem to assume that running a gcc 4.3 compiled binary requires a
>  > >  gcc update. That is not necessarily true.
>  >
>  > It (sometimes) requires a libgcc and libstdc++ update.
>
>  "Sometimes" is correct; many users commonly run newer compilers on older
>  distros, with LD_LIBRARY_PATH set to pick up the correct C++ support
>  library.  This is particularly common on servers, where you don't want to
>  mess with a working system but you might need to run newer code.
>
>  So, we've been arguing for a while, so the question is what to do.
>
>  Using a principle based on the old IETF concept of being liberal in what
>  you accept, and conservative in what you send, I think that both the Linux
>  kernel and gcc should fix the problem.  The kernel should fix the
>  information leak, and gcc should remove the assumption that the direction
>  flag is set in a given direction on function entry.
>
>  The gcc patch will be too late for 4.3.0, but it would be on the 4.3
>  branch, and we would recommend that distros pick it up for any compilers
>  they ship.

A patched GCC IMHO makes only sense if it is always-on, yet another option
won't help in corner cases.  And corner cases is exactly what people seem
to care about.  For this reason that we have this single release, 4.3.0, that
behaves "bad" is already a problem.

Richard.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/