linux-kernel - Re: [BUG] What is "__ptrval__" in my dmesg logs? Bad "%p" expansion?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190203143544.GA24267@localhost.localdomain>
Date:   Sun, 3 Feb 2019 22:35:44 +0800
From:   Tom Li <tomli@...li.me>
To:     Chris Rankin <rankincj@...il.com>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [BUG] What is "__ptrval__" in my dmesg logs? Bad "%p" expansion?

This is not a bug, rather, this is a security feature that fixes
the original behavior, which is now considered an infoleak vul-
nerability.

Currently, the address of internal data structures are protected
by Kernel Address Space Layout Randomization (KASLR), it forces
attackers to bruteforce the location they need to overwrite, thus
together with W^X mappings, increases the difficulty of exploiting
the kernel. However, showing values of raw pointers will reveal an
address of a known internal data structure, allowing an attacker to
calculate the location of critical data structure within the kernel,
therefore completely defeating the protection by ASLR. This is why
disallowing normal users to "dmesg" used to considered a way to
improve system security.

As a security measure, the value of "%p" is now hidden by default.

Happy Hacking,
Tom Li