[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2236FBA76BA1254E88B949DDB74E612B41BF84FF@IRSMSX102.ger.corp.intel.com>
Date: Tue, 25 Oct 2016 07:57:52 +0000
From: "Reshetova, Elena" <elena.reshetova@...el.com>
To: Kees Cook <keescook@...omium.org>
CC: "kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>, Hans Liljestrand
<ishkamiel@...il.com>, David Windsor <dwindsor@...il.com>
Subject: RE: [RFC v2 PATCH 01/13] Add architecture independent hardened
atomic base
On Thu, Oct 20, 2016 at 3:25 AM, Elena Reshetova <elena.reshetova@...el.com> wrote:
> This series brings the PaX/Grsecurity PAX_REFCOUNT [1] feature support
> to the upstream kernel. All credit for the feature goes to the feature
> authors.
>
> The name of the upstream feature is HARDENED_ATOMIC and it is
> configured using CONFIG_HARDENED_ATOMIC and HAVE_ARCH_HARDENED_ATOMIC.
>
> This series only adds x86 support; other architectures are expected to
> add similar support gradually.
> [...]
> Bugs Prevented
> --------------
> HARDENED_ATOMIC would directly mitigate these Linux kernel bugs:
>
> CVE-2016-3135 - Netfilter xt_alloc_table_info integer overflow
> CVE-2010-2959 - CAN integer overflow vulnerability, related post:
> https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overfl
> ow/
>These CVEs are "regular" integer overflows, rather than ref-counting flaws, so they should be left off the example list. (On kernsec.org, ref counting is a sub-set of integer overflow flaws, but the exploit examples are all merged together; Sorry for the > confusion!)
> CVE-2016-0728 - Keyring refcount overflow
>Exploit link is https://www.exploit-db.com/exploits/39277/
> CVE-2014-2851 - Group_info refcount overflow
>Exploit link is https://www.exploit-db.com/exploits/32926/
>
> And a relatively fresh exploit example:
> https://www.exploit-db.com/exploits/39773/
>For completeness, this is CVE-2016-4558.
I will fix all above! Thanks for pointing!
> [...]
> Documentation/security/hardened-atomic.txt | 141 +++++++++++++++
>Nit on whitespace: I get warnings from git about trailing whitespace in this file.
David, would you be able to submit a fix for Documentation? You were planning to update the wording in it also, so I think this can be handled at the same time.
Best Regards,
Elena.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
