oss-sec mailing list archives
Re: Asserts considered harmful (or GMP spills its sensitive information)
From: nisse () lysator liu se (Niels Möller)
Date: Tue, 01 Jan 2019 12:07:17 +0100
Jeffrey Walton <noloader () gmail com> writes:
The GMP library uses asserts to crash a program at runtime when presented with data it did not expect. The library also ignores user requests to remove asserts using Posix's -DNDEBUG. Posix asserts are a deugging aide intended for developement, and using them in production software ranges from questionable to insecure.
Crashing in a controlled fashion may also be *more* secure that continuing execution with undefined results. Depending on circumstances, of course. I read the general statement "asserts considered harmful" as your personal opionion, likely based on experience with very different development projects than I'm involved with. And gmp-bugs isn't really the right place for that debate (and neither is the nettle mailinglist).
Second, the SIGABRT terminates the process and can write a core file.
A security sensitive application can easily disable generation of core files, using setrlimit (on the linux kernel, prctl may also be useful). That's all part of crashing in a *controlled* fashion on assertion failures. As far as I'm aware, disabling core dumps is a fairly common practice in security sensitive applications. (And besides, most systems have zero ulimit -c as the system default these days. Which makes sense to me (any application might handle data that is sensitive to the user), even though as a developer, it's annoying with extra hoops required to get proper core dumps, including disabling the core dump collection "services" you mention). And as Vincent says, there are many ways to crash due to bugs, without triggering any assertion failure. And you should avoid generating core dumps for those crashes too. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.
Current thread:
- Re: Asserts considered harmful (or GMP spills its sensitive information) Matthew Fernandez (Jan 01)
- Disabling ptrace (was Re: [oss-security] Asserts considered harmful (or GMP spills its sensitive information)) Niels Möller (Jan 01)
- Re: Disabling ptrace Jakub Wilk (Jan 02)
- Re: Disabling ptrace Niels Möller (Jan 02)
- Re: Disabling ptrace Jakub Wilk (Jan 02)
- <Possible follow-ups>
- Re: Asserts considered harmful (or GMP spills its sensitive information) Niels Möller (Jan 01)
- Re: Re: Asserts considered harmful (or GMP spills its sensitive information) Simon McVittie (Jan 01)
- Re: Re: Asserts considered harmful (or GMP spills its sensitive information) halfdog (Jan 01)
- Re: Re: Asserts considered harmful (or GMP spills its sensitive information) Jeffrey Walton (Jan 02)
- Re: Re: Asserts considered harmful (or GMP spills its sensitive information) halfdog (Jan 02)
- Re: Re: Asserts considered harmful (or GMP spills its sensitive information) Simon McVittie (Jan 01)
- Disabling ptrace (was Re: [oss-security] Asserts considered harmful (or GMP spills its sensitive information)) Niels Möller (Jan 01)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Vincent Lefevre (Jan 01)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Niels Möller (Jan 01)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Torbjörn Granlund (Jan 01)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Jeffrey Walton (Jan 01)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Jeffrey Walton (Jan 01)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Niels Möller (Jan 06)
- Re: Asserts considered harmful (or GMP spills its sensitive information) Niels Möller (Jan 01)