oss-sec mailing list archives
Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities
From: Daniel Micay <danielmicay () gmail com>
Date: Tue, 22 Sep 2015 17:31:03 -0400
On 22/09/15 04:42 AM, Florian Weimer wrote:
On 09/21/2015 08:45 PM, Daniel Micay wrote:CVE-2015-1800 is prevented by the STRUCTLEAK GCC plugin.So I'm wrong about this part, as pipacs pointed out the __user marking is missing here, so it won't memset it in this case. The missing __user would be found by upstream's sparse tool or the PaX checker plugin though. The STRUCTLEAK plugin could also be extended to zero based on the copy_*_user calls, but that's probably not very useful since the missing __user markings could just be found via the existing tooling and fixed.Did you measure the performance impact of initializing *all* local variables to zero? If the variable is not addressible (that is, if it is an SSA_NAME), this is essentially free. In our testing, we only saw a performance loss in socket address handling, where a large placeholder struct is allocated, and the performance loss is quite noticeable when processing small packets. Unfortunately, this is were information disclosure happens in the past, so excluding this very spot for performance reasons is not very satisfying. The GCC patch we used is here: <https://gcc.gnu.org/ml/gcc-patches/2014-06/msg00615.html>
I haven't measured it, but I've considered trying it. The kernel tries to keep stack usage very low so it seems like it wouldn't usually hurt performance much, but that doesn't really hold up when functions are called repeatedly. It can probably optimize out the zeroing in many cases where it's not just an SSA value as long as everything is initialized but padding will mess with that. FWIW, spender posted a tiny patch extending the STRUCTLEAK plugin to cover all structs declared in headers with 'uapi' in the name, which should be most of the ones passed to userspace, although not in this 3.4 kernel for the S4 because it predates the uapi split. Might still be useful to have the plugin trace back from copy_*_user but that's more effort.
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Samsung S4 (GT-I9500) multiple kernel vulnerabilities Jonathan Salwan (Sep 21)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Daniel Micay (Sep 21)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Daniel Micay (Sep 21)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Daniel Micay (Sep 21)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Florian Weimer (Sep 22)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Daniel Micay (Sep 22)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Daniel Micay (Sep 21)
- Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities Daniel Micay (Sep 21)