linux-kernel - Re: [PATCH 4.14 06/40] efi: libstub: Disable struct randomization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXHOMuaBeR_LqVBKVtmGaJQg5hznSxow5bosQ9+NzhZ72A@mail.gmail.com>
Date:   Mon, 26 Sep 2022 16:16:02 +0200
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Pavel Machek <pavel@...x.de>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Daniel Marth <daniel.marth@...o.tuwien.ac.at>,
        Kees Cook <keescook@...omium.org>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.14 06/40] efi: libstub: Disable struct randomization

On Mon, 26 Sept 2022 at 13:08, Pavel Machek <pavel@...x.de> wrote:
>
> Hi!
>
> > These structs look like the ideal randomization candidates to the
> > randstruct plugin (as they only carry function pointers), but of course,
> > these protocols are contracts between the firmware that exposes them,
> > and the EFI applications (including our stubbed kernel) that invoke
> > them. This means that struct randomization for EFI protocols is not a
> > great idea, and given that the stub shares very little data with the
> > core kernel that is represented as a randomizable struct, we're better
> > off just disabling it completely here.
>
> > Cc: <stable@...r.kernel.org> # v4.14+
>
> AFAICT RANDSTRUCT_CFLAGS is not available in v4.19, so we should not
> take this patch.
>

Ugh, as it turns out, this macro doesn't exist before v5.19 so it
should not be backported beyond that version at all.

Greg, can you please drop this patch from all the -stable trees except
v5.19? Thanks, and apologies for creating confusion.