oss-security - Re: Re: More CONFIG_VMAP_STACK vulnerabilities, refcount_t UAF, and an ignored Secure Boot bypass / rootkit method

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABniQZPtHV+-XiHPRUGcDe+KwEd1JpPdcDb2Xn63t2Z_Os6ETQ@mail.gmail.com>
Date: Sat, 24 Jun 2017 23:26:00 +0800
From: Shawn <citypw@...il.com>
To: oss-security@...ts.openwall.com
Cc: Brad Spengler <spender@...ecurity.net>, pageexec@...email.hu, 
	kernel-hardening@...ts.openwall.com
Subject: Re: Re: More CONFIG_VMAP_STACK vulnerabilities,
 refcount_t UAF, and an ignored Secure Boot bypass / rootkit method

Hi Linus,

Not sure how you got the conclusion like "Their patches are pure
garbage."( https://www.spinics.net/lists/kernel/msg2540934.html). I'm
wondering why there's a group of ppl called themselves KSPP got paid
by big corps are still trying to copy+paste PaX/Grsecurity to the
upstream if you think it's a garbage? Did you try to tell KSPP guys to
stop their work( cc'ing kernel-hardening mailinglist)? It's so obvious
to see the most security work( more than just a specific OS)
originally done by PaX/Grsecurity:

https://github.com/hardenedlinux/grsecurity-101-tutorials/blob/master/kernel_mitigation.md

And my customers has been suffering from your philosophical ideas of
"A bug is bug" for too long. I really respect your contributions(
linux kernel/git) to the FLOSS world. But even the open source king
can't change the truth:

https://github.com/hardenedlinux/grsecurity-101-tutorials/blob/master/kernel_vuln_exp.md

btw: You didn't answer Brad's question.

On Sat, Jun 24, 2017 at 9:04 AM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
> On Fri, Jun 23, 2017 at 5:50 PM, Brad Spengler <spender@...ecurity.net> wrote:
>>
>> BTW, we're happy to go toe-to-toe with you here in public on actual facts
>> instead of pathetic ad hominems.
>
> Quite frankly, I'd much rather see *you* actually send in patches that
> are acceptable for inclusion, something you've never done.
>
> As it is, other people have tried to clean up parts of the grsecurity
> patches, and tried to make them acceptable.
>
> Wouldn't it be nice if you actually tried to make the baseline actually better?
>
> Please.
>
>                 Linus

-- 
GNU powered it...
GPL protect it...
God blessing it...

regards
Shawn

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.