linux-kernel - Re: Potential info leak: Kernel pointer leak?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190123122429.GO4635@vkoul-mobl>
Date:   Wed, 23 Jan 2019 17:54:29 +0530
From:   Vinod Koul <vkoul@...nel.org>
To:     Fuqian Huang <huangfq.daxian@...il.com>
Cc:     linux-kernel@...r.kernel.org, dmaengine@...r.kernel.org,
        linux-soc@...r.kernel.org, linux-arm-msm@...r.kernel.org
Subject: Re: Potential info leak: Kernel pointer leak?

On 22-01-19, 21:25, Fuqian Huang wrote:
> Hi, recently I came across some code and it seems to be able to leak
> kernel address?
> Is the following code cause info leak in the Linux kernel?
> The callback function address is printed to debugfs.
> The local user could know the kernel object address, and is able to
> bypass kASLR.
> linux-4.14.90
> drivers/dma/qcom/hidma_dbg.c:46
> function - hidma_ll_chstats

Doesnt %p not print kernel addresses anymore, see
Documentation/core-api/printk-formats.rst

> 
> The hidma_ll_chstats function in drivers/dma/qcom/hidma_dbg.c in the
> Linux kernel 4.14.90 allows local users to obtain sensitive address
> information by reading "callback=" lines in a debugfs file.
> 
> Similar to CVE-2018-7754

-- 
~Vinod