netdev - Re: [PATCH] e1000e: write protect ICHx NVM to prevent malicious write/erase

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0810021154330.1887@twin.jikos.cz>
Date:	Thu, 2 Oct 2008 11:59:53 +0200 (CEST)
From:	Jiri Kosina <jkosina@...e.cz>
To:	Jesse Brandeburg <jesse.brandeburg@...el.com>
cc:	torvalds@...ux-foundation.org, jeff@...zik.org,
	davem@...emloft.net, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, arjan@...ux.intel.com,
	Bruce Allan <bruce.w.allan@...el.com>, arjan@...ux.intel.com
Subject: Re: [PATCH] e1000e: write protect ICHx NVM to prevent malicious
 write/erase

On Wed, 1 Oct 2008, Jesse Brandeburg wrote:

> Set the hardware to ignore all write/erase cycles to the GbE region in 
> the ICHx NVM.  This feature can be disabled by the WriteProtectNVM 
> module parameter (enabled by default) only after a hardware reset, but 
> the machine must be power cycled before trying to enable writes.

Hi,

thanks. We have been running our tests with complete pileup of 12 patches 
from Intel, and the bug didn't trigger so far (and it triggers now pretty 
reliably with the unpatched kernel in the setup Karsten has established in 
our testing environment).

So the patches really seem, as far as our current testing goes, to 
at least workaround the problem.

I will now try to isolate which of the patches really fixes the problem, 
so that we could understand better what is going on and who is causing the 
corruption.

Do you think it would be possible to adapt this particular patch so that 
it spits out watnin/stacktrace when write and/or erase cycle is attempted 
but denied?

Thanks,

-- 
Jiri Kosina
SUSE Labs

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html