Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LRH.2.11.1409301931540.17801@fairfax.gathman.org>
Date: Tue, 30 Sep 2014 19:40:07 -0400 (EDT)
From: "Stuart D. Gathman" <stuart@...hman.org>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Healing the bash fork

On Tue, 30 Sep 2014, David A. Wheeler wrote:

> Finally: *PLEASE* let me know if you have any good ideas on how to
> find vulnerabilities like this ahead-of-time. My article "How to
> Prevent the Next Hearbleed"
> (http://www.dwheeler.com/essays/heartbleed.html) lists a number of
> ways that Heartbleed-like vulnerabilities could have been detected
> ahead-of-time, in ways that are general enough to be useful.  I'd like
> to do the same with Shellshock, so we can quickly eliminate a whole
> class of problems.

I don't know if this can be made efficient enought to be practical, but 
imagine a virtual machine where every byte of memory is tagged with the 
security domain.  When a byte is copied, the tag is copied also.  (It is 
not possible in general to distinguish copies from writes, but at least 
when copying between domains via system calls, this is detectable.) 
Then, when a privileged program is running, its memory can be scanned for 
data from a lower privilege domain.

I think this is optimizable, since most memory will have the same tag, 
and can be managed via virtual memory paging.  Update on write logic will 
create a more detailed map for "hot" pages.

Caveat: someone probably already did this, and I just never heard of it.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.