netdev - Re: [PATCH net-next-2.6] pktgen: Optionally leak kernel memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1279980795.2451.157.camel@edumazet-laptop>
Date:	Sat, 24 Jul 2010 16:13:15 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Ben Greear <greearb@...delatech.com>
Cc:	David Miller <davem@...emloft.net>, NetDev <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next-2.6] pktgen: Optionally leak kernel memory

Le samedi 24 juillet 2010 à 06:18 -0700, Ben Greear a écrit :

> I think most users of pktgen wouldn't be too concerned about leaking
> memory content to the network.  It's a root-only test tool that can easily
> saturate most networks and do horrible things like overflow switch CAM tables
> by randomizing source/dest macs etc.  So, this warning might could be a bit
> more descriptive of how it is a security problem "arbitrary contents of memory can be
> sent across the network and may be sniffed by devices on the network, potentially
> revealing private information such as passwords and application data for applications
> running on the machine running pktgen" instead of telling folks not to use it unless it's
> really needed.

Most of the horrible things you mention are not related to the memset()
thing, arent they ?

Being root means : "I am a trusted user on this machine, and as such,
must know a bit what security means".

It doesnt mean : "I am allowed to steal passwords, credit card numbers,
from gentle users. I am allowed to blow up the LAN with billions of evil
frames". Still, pktgen is there and might be used by a fool.

The "UNSAFE" label should be more than enough to warn the fool admin ;)

Note this "UNSAFE" thing is really bad. Nowhere in the kernel we are
allowed to make this sort of thing : No special mmap() flag asking
kernel to give non cleared memory pages, even to root user.

I am not sure David will accept the patch !

Anyway, as I said, if you want to saturate a 10Gb+ network with pktgen,
you probably need clone_skb ?

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html