Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #59510 > unrolled thread
| Started by | intrigeri@debian.org |
|---|---|
| First post | 2017-11-29 10:50 +0100 |
| Last post | 2018-02-13 13:10 +0100 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.debian.kernel
Bug#883069: linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED intrigeri@debian.org - 2017-11-29 10:50 +0100
Processed: Re: Bug#883069: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED "Debian Bug Tracking System" <owner@bugs.debian.org> - 2018-02-13 13:10 +0100
Bug#883069: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED intrigeri <intrigeri@debian.org> - 2018-02-13 13:10 +0100
| From | intrigeri@debian.org |
|---|---|
| Date | 2017-11-29 10:50 +0100 |
| Subject | Bug#883069: linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED |
| Message-ID | <uR7a9-852-1@gated-at.bofh.it> |
Package: src:linux
Version: 4.14-1~exp1
Severity: wishlist
User: tails-dev@boum.org
Usertags: hardening
Hi!
(sorry if that's a duplicate, the BTS web interface has been unable to
show me the list of src:linux bugs since a few days so I gave up and
decided to report this.)
As usual when a new upstream kernel is released I went through Kees
Cook's post [0] to look for things we might want to opt-in for
in Debian.
Besides new GCC plugins (CONFIG_GCC_PLUGINS is disabled in Debian
"Until we work out how to package them"), the only candidate that
requires opt-in seems to be CONFIG_SLAB_FREELIST_HARDENED, which
"should render blind heap overflow bugs much more difficult to
exploit" + adds a naive detection of double free or corruption:
config SLAB_FREELIST_HARDENED
bool "Harden slab freelist metadata"
depends on SLUB
help
Many kernel heap attacks try to target slab cache metadata and
other infrastructure. This options makes minor performance
sacrifies to harden the kernel slab allocator against common
freelist exploit methods.
Do you think this could be an acceptable performance/security
trade-off for Debian?
If it helps making a decision I could hunt for benchmark results (the
KSPP people tend to attach these to their pull requests when it
matters).
[0] https://outflux.net/blog/archives/2017/11/14/security-things-in-linux-v4-14/
Cheers,
--
intrigeri
[toc] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2018-02-13 13:10 +0100 |
| Subject | Processed: Re: Bug#883069: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED |
| Message-ID | <viHzk-6Lp-13@gated-at.bofh.it> |
| In reply to | #59510 |
Processing control commands: > tag -1 + pending Bug #883069 [src:linux] linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED Added tag(s) pending. > found -1 4.14.13-1 Bug #883069 [src:linux] linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED Marked as found in versions linux/4.14.13-1. > found -1 4.15~rc8-1~exp1 Bug #883069 [src:linux] linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED Marked as found in versions linux/4.15~rc8-1~exp1. > retitle -1 Please consider enabling CONFIG_SLAB_FREELIST_HARDENED Bug #883069 [src:linux] linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED Changed Bug title to 'Please consider enabling CONFIG_SLAB_FREELIST_HARDENED' from 'linux-image-4.14.0-trunk-amd64: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED'. -- 883069: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883069 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | intrigeri <intrigeri@debian.org> |
|---|---|
| Date | 2018-02-13 13:10 +0100 |
| Subject | Bug#883069: Please consider enabling CONFIG_SLAB_FREELIST_HARDENED |
| Message-ID | <viHzj-6Lp-11@gated-at.bofh.it> |
| In reply to | #59510 |
Control: tag -1 + pending Control: found -1 4.14.13-1 Control: found -1 4.15~rc8-1~exp1 Control: retitle -1 Please consider enabling CONFIG_SLAB_FREELIST_HARDENED Hi, CONFIG_SLAB_FREELIST_HARDENED was enabled in commit 3fa67126b5924 and is documented as pending in the changelog for 4.15.2-1~exp1. Thanks! Cheers, -- intrigeri
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web