linux-kernel - Re: [PATCH 3/3] [v3] lib/vsprintf: debug_never_hash_pointers prints all addresses as unhashed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Feb 2021 12:16:55 -0600
From:   Timur Tabi <timur@...nel.org>
To:     Petr Mladek <pmladek@...e.com>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Matthew Wilcox <willy@...radead.org>,
        akpm@...ux-foundation.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        roman.fietze@...na.com, Kees Cook <keescook@...omium.org>,
        John Ogness <john.ogness@...utronix.de>,
        akinobu.mita@...il.com, glider@...gle.com,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Marco Elver <elver@...gle.com>,
        Rasmus Villemoes <linux@...musvillemoes.dk>,
        Pavel Machek <pavel@....cz>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH 3/3] [v3] lib/vsprintf: debug_never_hash_pointers prints
 all addresses as unhashed



On 2/11/21 11:53 AM, Petr Mladek wrote:
> I would really like to make it clear here that it is not only about
> consoles. Most people will see only this message. Only few people read
> documentation. Many people will learn the parameter name from another
> context by googling.
> 
> I know that it is not easy to find good words. Especially because
> pointers printed by %pK might still be hashed.
> 
>> +	pr_warn("**                                                      **\n");
>> +	pr_warn("** Kernel memory addresses are exposed, which may       **\n");
>> +	pr_warn("** reduce the security of your system.                  **\n");

> What about replacing the first two paragraphs with something like:
> 
> "This system shows unhashed kernel memory addresses via logs and
>   other interfaces. It might reduce the security of your system."

That works, thanks.  I'll post a v4 soon.