lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 20 Dec 2014 17:11:12 -0800
From:	Andy Lutomirski <>
To:	Ingo Molnar <>, X86 ML <>
Cc:	"" <>,
	Kees Cook <>
Subject: [GIT PULL] one vdso fix for x86/urgent

Hi Ingo, etc,

Please consider pulling for x86/urgent.  This fixes a longstanding,
albeit relatively minor, issue in the x86 vdso randomization
algorithm.  Note that this isn't super-urgent, as this bug isn't
directly exploitable, and it's as old as the vdso itself.


The following changes since commit e589c9e13aeb0c5539bf1314b3a78442ea8fc0c2:

  Merge branch 'x86-apic-for-linus' of
git:// (2014-12-19
14:02:02 -0800)

are available in the git repository at:


for you to fetch changes up to 394f56fe480140877304d342dec46d50dc823d46:

  x86_64, vdso: Fix the vdso address randomization algorithm
(2014-12-20 16:56:57 -0800)

One vdso fix for a longstanding ASLR bug that's been in the news lately.

The vdso base address has always been randomized, and I don't think there's
anything particularly wrong with the range over which it's randomized,
but the implementation seems to have been buggy since the very beginning.

This fixes the implementation to remove a large bias that caused a small
fraction of possible vdso load addresess to be vastly more likely than
the rest of the possible addresses.

Andy Lutomirski (1):
      x86_64, vdso: Fix the vdso address randomization algorithm

 arch/x86/vdso/vma.c | 45 +++++++++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 16 deletions(-)
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists