oss-security - Re: Linux kernel address leaks

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190418172349.GA24716@kroah.com>
Date: Thu, 18 Apr 2019 19:23:49 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel address leaks

On Thu, Apr 18, 2019 at 07:00:58PM +0200, Solar Designer wrote:
> Hi,
> 
> Fuqian just sent us all 13 of these in 2 days, and I guess there might
> be many more to come.  Do we really want to see them in here?  And in
> that many individual messages?  I doubt it - but not enough to have used
> my moderator powers to outright reject the messages without discussion.

If you look at the original commit that added the pointer masking logic
to the kernel in the 4.15 release:
	ad67b74d2469 ("printk: hash addresses printed with %p")

it points out that there are currently about 14000 different uses of
this in the kernel at the time, so the proper way to "fix" this is to
just make it so %p does not print out the pointer address.

Today, I responded to one patch that the author sent to the stable
mailing list with the following message:
	I suggest, if you really care about this issue in your
	4.14-based kernel tree, that you just backport these pointer
	printk patches and be done with it.  That's too big of a change
	to accept into the 4.14.y LTS kernel, but as the lifespan for
	4.14.y running on a "general purpose" system is probably only a
	few more months at most, I would recomment just using 4.19.y
	instead as this isn't an issue at all there.

So in short, use 4.15 or newer if you care about this issue.  If you
rely on an older kernel, please backport the above patch, and a few
others, to your kernel and be done with the issue.  That's what Android
has done, so all of those devices do not have this issue anymore either.

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.