linux-kernel - Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Aug 2017 10:01:31 -0500 (CDT)
From:   Christopher Lameter <cl@...ux.com>
To:     Kees Cook <keescook@...omium.org>
cc:     Laura Abbott <labbott@...hat.com>,
        Pekka Enberg <penberg@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linux-MM <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Rik van Riel <riel@...hat.com>
Subject: Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path

On Mon, 7 Aug 2017, Kees Cook wrote:
>
> To clarify, this is desirable to kill exploitation of
> exposure-after-free flaws and some classes of use-after-free flaws,
> since the contents will have be wiped out after a free. (Verification
> of poison is nice, but is expensive compared to the benefit against
> these exploits -- and notably doesn't protect against the other
> use-after-free attacks where the contents are changed after the next
> allocation, which would have passed the poison verification.)

Well the only variable in the freed area that is in use by the allocator
is the free pointer. This ensures that complete object is poisoned and the
free pointer has a separate storage area right? So the size of the slab
objects increase. In addition to more hotpath processing we also have
increased object sizes.

I am not familiar with the terminology here.

So exposure-after-free means that the contents of the object can be used
after it was freed?

Contents are changed after allocation? Someone gets a pointer to the
object and the mods it later?