lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 18 Nov 2010 08:48:04 +0100 From: Ingo Molnar <mingo@...e.hu> To: Kyle McMartin <kyle@...artin.ca> Cc: Marcus Meissner <meissner@...e.de>, torvalds@...ux-foundation.org, linux-kernel@...r.kernel.org, tj@...nel.org, akpm@...l.org, hpa@...or.com, w@....eu, alan@...rguk.ukuu.org.uk, Andrew Morton <akpm@...ux-foundation.org> Subject: Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking * Kyle McMartin <kyle@...artin.ca> wrote: > On Tue, Nov 16, 2010 at 11:46:03AM +0100, Marcus Meissner wrote: > > Target of this starter patch and follow ups is removing any kind of > > kernel space address information leak from the kernel. > > > > Er. Should probably hit /proc/modules while you're at it. Agreed. A few other kernel address things that should be hidden are: 1) /proc/<PID>/stack Gives out kernel addresses and is a partial /proc/kallsyms table in essence. This got introduced recently. Useful to attackers. Then there's a handful of physical address leaks - those are less useful but useful in some situations: 2) /proc/mtrr Gives some idea about the physical layout of the machine and can give information about the location of certain physical devices as well. Limited but nonzero utility to attackers. 3) /proc/asound/cards Can gives out the physical address of a device. Limited but nonzero utility to attackers. 4) /sys/devices/*/*/resources Shows physical addresses. Limited but nonzero utility to attackers. Plus there's some really limited fractional pieces of information - again, of nonzero utility to attackers: 5) /proc/net/ptype Shows the sizes of a few kernel functions in networking code. Very limited but nonzero utility to attackers. 6) /sys/kernel/slab/*/ctor Shows the sizes of a few kernel functions. Very limited but nonzero utility to attackers. 7) /sys/module/*/sections/* For example: /sys/module/sunrpc/sections/__bug_table /sys/module/sunrpc/sections/__ex_table /sys/module/sunrpc/sections/__ksymtab /sys/module/sunrpc/sections/__ksymtab_gpl /sys/module/sunrpc/sections/__ksymtab_strings /sys/module/sunrpc/sections/__mcount_loc /sys/module/sunrpc/sections/__param Potentially useful to attackers. There's probably a few more i missed. Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists