[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAH0z3hNq8mSGrMcE2Zr_o5OOEcdA7gkZ4iZTC6d7+kav+70jYA@mail.gmail.com>
Date: Sun, 20 Jan 2019 15:53:18 -0800
From: Vlad Tsyrklevich <vlad@...rklevich.net>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Unfixed FreeBSD uninitialized memory disclosures
In January 2017 I reported results of a clang analyzer-based static
analysis step [1] to find uninitialized kernel-to-userland memory
disclosures against a number of kernels. I reported results in the FreeBSD
kernel to their security team. Over the next 2 years some [2][3][4] of the
bugs were fixed but it seems like only when they were re-reported.
I re-ran the analyzer against an updated FreeBSD kernel and reported
updated results [5] last month--the crossed out reports are false positives
as determined by manual inspection. Though the impact of these bugs is not
critical, they are worth fixing. I've contacted the security team again but
it did not sound like these reports were prioritized to be fixed
immediately. I'm e-mailing oss-security to let other downstream FreeBSD
users patch them on their own if they were so inclined. Most of them can be
fixed by simply adding a memset() or an M_ZERO to malloc().
[1] https://tsyrklevich.net/2017/03/27/kernel-clang-analyzer/
[2] https://www.freebsd.org/security/advisories/FreeBSD-SA-17:10.kldstat.asc
[3] https://www.freebsd.org/security/advisories/FreeBSD-EN-18:05.mem.asc
[4] https://www.freebsd.org/security/advisories/FreeBSD-EN-18:12.mem.asc
[5] https://tsyrklevich.net/clang_analyzer/freebsd_122818/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
