Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 Oct 2020 01:44:14 +0100
From: Matthew Wilcox <>
To: Jann Horn <>
Cc: Alexander Popov <>,
	Kees Cook <>, Will Deacon <>,
	Andrey Ryabinin <>,
	Alexander Potapenko <>,
	Dmitry Vyukov <>,
	Christoph Lameter <>, Pekka Enberg <>,
	David Rientjes <>,
	Joonsoo Kim <>,
	Andrew Morton <>,
	Masahiro Yamada <>,
	Masami Hiramatsu <>,
	Steven Rostedt <>,
	Peter Zijlstra <>,
	Krzysztof Kozlowski <>,
	Patrick Bellasi <>,
	David Howells <>,
	Eric Biederman <>,
	Johannes Weiner <>,
	Laura Abbott <>, Arnd Bergmann <>,
	Greg Kroah-Hartman <>,
	Daniel Micay <>,
	Andrey Konovalov <>,
	Pavel Machek <>,
	Valentin Schneider <>,
	kasan-dev <>,
	Linux-MM <>,
	Kernel Hardening <>,
	kernel list <>,
Subject: Re: [PATCH RFC v2 0/6] Break heap spraying needed for exploiting

On Tue, Oct 06, 2020 at 12:56:33AM +0200, Jann Horn wrote:
> It seems to me like, if you want to make UAF exploitation harder at
> the heap allocator layer, you could do somewhat more effective things
> with a probably much smaller performance budget. Things like
> preventing the reallocation of virtual kernel addresses with different
> types, such that an attacker can only replace a UAF object with
> another object of the same type. (That is not an idea I like very much
> either, but I would like it more than this proposal.) (E.g. some
> browsers implement things along those lines, I believe.)

The slab allocator already has that functionality.  We call it
TYPESAFE_BY_RCU, but if forcing that on by default would enhance security
by a measurable amount, it wouldn't be a terribly hard sell ...

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.