Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1352798

Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI)

From James Morris <james.l.morris@oracle.com>
Newsgroups linux.kernel
Subject Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI)
Date 2016-03-08 10:40 +0100
Message-ID <ramht-7tc-19@gated-at.bofh.it> (permalink)
References (6 earlier) <ra84O-6rV-27@gated-at.bofh.it> <ra8xQ-6CZ-21@gated-at.bofh.it> <ra9kg-7bJ-49@gated-at.bofh.it> <ra9tV-7f4-31@gated-at.bofh.it> <raded-1go-73@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On 03/08/2016 10:48 AM, James Morris wrote:
> On 03/08/2016 06:54 AM, Andy Lutomirski wrote:
>>
>> This makes sense, but I still think the design is poor.  If the hacker
>> gets code execution, then they can trivially brute force the ADI bits.
>>
>
> ADI in this scenario is intended to prevent the attacker from gaining
> code execution in the first place.

Here's some more background from Enrico Perla (who literally wrote the 
book on kernel exploitation):

https://blogs.oracle.com/enrico/entry/hardening_allocators_with_adi

Probably the most significant advantage from a security point of view is 
the ability to eliminate an entire class of vulnerability: adjacent heap 
overflows, as discussed above, where, for example, adjacent heap objects 
are tagged differently.  Classic linear buffer overflows can be eliminated.

As Kees Cook outlined at the 2015 kernel summit, it's best to mitigate 
classes of vulnerabilities rather than patch each instance:

https://outflux.net/slides/2011/defcon/kernel-exploitation.pdf

The Linux ADI implementation is currently very rudimentary, and we 
definitely welcome continued feedback from the community and ideas as it 
evolves.

- James

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-06 05:10 +0100
  Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 16:10 +0100
    Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Rob Gardner <rob.gardner@oracle.com> - 2016-03-07 16:40 +0100
      Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 16:50 +0100
      Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 16:50 +0100
        Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 17:10 +0100
          Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Dave Hansen <dave.hansen@linux.intel.com> - 2016-03-07 18:50 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 19:00 +0100
              Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Dave Hansen <dave.hansen@linux.intel.com> - 2016-03-07 19:20 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 19:50 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 20:00 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 20:30 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 20:50 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Dave Hansen <dave.hansen@linux.intel.com> - 2016-03-07 23:50 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Rob Gardner <rob.gardner@oracle.com> - 2016-03-08 02:40 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 22:10 +0100
              Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-08 21:00 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-08 21:20 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-08 21:30 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-08 22:10 +0100
    Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 17:50 +0100
      Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 19:00 +0100
    Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 18:00 +0100
      Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 19:10 +0100
        Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 19:30 +0100
          Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 20:00 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 20:30 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 20:50 +0100
              Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 21:00 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 21:50 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 22:00 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity (ADI) Andy Lutomirski <luto@amacapital.net> - 2016-03-07 22:10 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 22:20 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) James Morris <james.l.morris@oracle.com> - 2016-03-08 00:40 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) James Morris <james.l.morris@oracle.com> - 2016-03-08 01:00 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) James Morris <james.l.morris@oracle.com> - 2016-03-08 10:40 +0100
      Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 19:10 +0100
        Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Rob Gardner <rob.gardner@oracle.com> - 2016-03-07 19:20 +0100
          Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 19:30 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 20:20 +0100
              Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 22:40 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 22:40 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Rob Gardner <rob.gardner@oracle.com> - 2016-03-08 00:20 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-08 05:20 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Rob Gardner <rob.gardner@oracle.com> - 2016-03-08 00:20 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-08 00:30 +0100
              Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-08 01:30 +0100
                Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-08 05:30 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Rob Gardner <rob.gardner@oracle.com> - 2016-03-08 00:40 +0100
        Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 20:10 +0100
          Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 22:30 +0100
            Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) David Miller <davem@davemloft.net> - 2016-03-07 22:40 +0100
              Re: [PATCH v2] sparc64: Add support for Application Data Integrity  (ADI) Khalid Aziz <khalid.aziz@oracle.com> - 2016-03-07 23:40 +0100

csiph-web