linux-kernel - Re: [PATCH] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG_fn=XBn-kKWdoPFhnfOGTXBaMfeziPQJCrgE7KvteSwYLmnA@mail.gmail.com>
Date:   Tue, 21 Apr 2020 10:06:16 +0200
From:   Alexander Potapenko <glider@...gle.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Alexey Dobriyan <adobriyan@...il.com>,
        LKML <linux-kernel@...r.kernel.org>, sunhaoyl@...look.com
Subject: Re: [PATCH] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()

> Ewww. That's been there for 12 years. Did something change in
> regset_size() or regset->get()? Do you know what leaves the hole?

I don't think anything changed on the kernel side recently.
But I've made some changes to DMA handling recently, which made uninit
writes to the disk discoverable.
We don't use core dumping on syzbot (because the auto-generated
programs crash all the time), so it could be a very old bug that was
triggered in a non-standard setup.