linux-kernel - Re: [tip: x86/bugs] x86/retpoline: Ensure default return thunk isn't used at runtime

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Oct 2023 20:44:31 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Josh Poimboeuf <jpoimboe@...nel.org>
Cc:     Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org,
        linux-tip-commits@...r.kernel.org,
        David Kaplan <david.kaplan@....com>,
        "Peter Zijlstra (Intel)" <peterz@...radead.org>, x86@...nel.org,
        David Howells <dhowells@...hat.com>
Subject: Re: [tip: x86/bugs] x86/retpoline: Ensure default return thunk isn't
 used at runtime

On Wed, Oct 18, 2023 at 11:39:15AM -0700, Josh Poimboeuf wrote:
> And see my reply to that?  Not trying to be daft, I just didn't see how
> your reply was responsive.
> 
> A single WARN_ONCE() has the benefit of not overflowing dmesg, while
> also making the warning available to those looking at dmesg (or the
> taint flag), as those who care should be.

A single WARN once is not enough as this is security-sensitive. Warns do
get ignored.

> A rate-limited WARN() is problematic, as it overflows dmesg (and
> possibly wrapping other logs), potentially obscuring other important
> data.

This will hopefully make people look by screaming louder. But no
guarantee. Not saying it is the right thing.

UDing without any output is not the right thing either.

All I'm saying is, there's no good solution for how to catch this and
make people report it.

Make more sense?

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette