linux-kernel - Re: [GIT pull] x86/urgent for 5.3-rc5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190828152040.GC2752@twin.jikos.cz>
Date:   Wed, 28 Aug 2019 17:20:41 +0200
From:   David Sterba <dsterba@...e.cz>
To:     Borislav Petkov <bp@...e.de>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Pu Wen <puwen@...on.cn>, Thomas Gleixner <tglx@...utronix.de>,
        Tom Lendacky <thomas.lendacky@....com>,
        Linux List Kernel Mailing <linux-kernel@...r.kernel.org>,
        the arch/x86 maintainers <x86@...nel.org>
Subject: Re: [GIT pull] x86/urgent for 5.3-rc5

On Tue, Aug 27, 2019 at 07:39:55PM +0200, Borislav Petkov wrote:
> @@ -42,5 +43,24 @@ void x86_init_rdrand(struct cpuinfo_x86 *c)
>  			return;
>  		}
>  	}
> +
> +	/*
> +	 * Stupid sanity-check whether RDRAND does *actually* generate
> +	 * some at least random-looking data.
> +	 */
> +	prev = tmp;
> +	for (i = 0; i < SANITY_CHECK_LOOPS; i++) {
> +		if (rdrand_long(&tmp)) {
> +			if (prev != tmp)
> +				changed++;

You could do some sort of weak statistical test like

		if (popcnt(prev ^ tmp) < BITS_PER_LONG / 3)
			bad++;

		if (bad > TOO_BAD)
			WARN(...);

this should catch same value, increments you mentioned and possibly
other trivial classes of not-so-random values.