linux-kernel - Re: TALPA - a threat model? well sorta.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080818133038.GA4819@ucw.cz>
Date:	Mon, 18 Aug 2008 15:30:38 +0200
From:	Pavel Machek <pavel@...e.cz>
To:	david@...g.hm
Cc:	Arjan van de Ven <arjan@...radead.org>,
	Eric Paris <eparis@...hat.com>, linux-kernel@...r.kernel.org,
	malware-list@...ts.printk.net, andi@...stfloor.org,
	riel@...hat.com, greg@...ah.com, tytso@....edu,
	viro@...IV.linux.org.uk, alan@...rguk.ukuu.org.uk,
	peterz@...radead.org, hch@...radead.org
Subject: Re: TALPA - a threat model?  well sorta.

Hi!

> >How does it work? Memory can still change after mmap; 
> >scanning at the
> >mmap time is _NOT_ enough.
> >
> >You could do 'when app attempts to dirty memory, 
> >synchronously unmap
> >it from all apps that have it mapped' and then do sync 
> >scan on
> >pagefault time; but that sounds impractical.
> 
> what is the threat you are trying to defend against?
> 
> for some threats you are right, for others the scan at 
> mmap time is enough.

I don't see any threats when check at mmap time is okay.

As soon as file servers use mmap, this race can bite you even in very
simple 'make sure Linux fileserver does not pass on windows malwar'
threat model.
							Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/