Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1372727

Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file

Show all headers | View raw

On Wed, Apr 6, 2016 at 11:05 AM,  <ed@abdsec.com> wrote:
>
> Most distros don't use KASLR, but they use kptr_restrict. Without KASLR,
> kptr_restirct most likely useless.

Well, yes kaslr is effectively useless right now due to the fact that
people still use hibernation in effectively every single distro out
there.

But kptr_restrict was enabled by distro people, and in theory it does
end up possibly helping: it at least it hides the exact per-function
addresses.

Of course, with 99.9% of all users then using a distro kernel, you can
just get those remotely anyway by just downloading the distro image,
so it turns out that now there is effectively zero bits that you are
really hiding, because the information is effectively right there in
"uname -a".

End result: kptr_restrict is a wonderful flag if all you want to
disable is a trivial convenience function that is easy for an attacker
to do other ways.

Quite frankly, personally I find a lot of security people and patches
to be disingenuous for exactly this kind of reason. They look at the
small details, and are completely missing the big picture.

I'm at the IoT conference right now. "Security" has been a big word
this week. "45 billion devices, lack of security, the sky is falling".
I don't think we had a lot of people talking about "oh, the cloud
service is getting shut down, so now those devices don't even *work*".

But that's ok. Because "security" is more important than "reality". Groan.

                Linus

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Emrah Demir <ed@abdsec.com> - 2016-04-06 16:00 +0200
  Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 17:30 +0200
    Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 20:00 +0200
      Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file ed@abdsec.com - 2016-04-06 20:10 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Kees Cook <keescook@chromium.org> - 2016-04-06 20:30 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Kees Cook <keescook@chromium.org> - 2016-04-06 20:40 +0200
          Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 20:50 +0200
            Re: [kernel-hardening] Re: [PATCH] KERNEL: resource: Fix bug on  leakage in /proc/iomem file Yves-Alexis Perez <corsac@debian.org> - 2016-04-06 21:00 +0200
              Re: [kernel-hardening] Re: [PATCH] KERNEL: resource: Fix bug on  leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 21:10 +0200
                Re: [kernel-hardening] Re: [PATCH] KERNEL: resource: Fix bug on  leakage in /proc/iomem file Borislav Petkov <bp@alien8.de> - 2016-04-06 21:20 +0200
                Re: [kernel-hardening] Re: [PATCH] KERNEL: resource: Fix bug on  leakage in /proc/iomem file Yves-Alexis Perez <corsac@debian.org> - 2016-04-06 21:20 +0200
                Re: [kernel-hardening] Re: [PATCH] KERNEL: resource: Fix bug on  leakage in /proc/iomem file Ingo Molnar <mingo@kernel.org> - 2016-04-06 23:50 +0200
            Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Bjørn Mork <bjorn@mork.no> - 2016-04-06 21:30 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 20:40 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Kees Cook <keescook@chromium.org> - 2016-04-06 21:00 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem  file Christian Kujau <lists@nerdbynature.de> - 2016-04-06 21:10 +0200
      Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 23:20 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Kees Cook <keescook@chromium.org> - 2016-04-06 23:30 +0200
          Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-06 23:40 +0200
        Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Kees Cook <keescook@chromium.org> - 2016-04-14 06:30 +0200
          Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Emrah Demir <ed@abdsec.com> - 2016-04-14 11:40 +0200
  Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file Kees Cook <keescook@chromium.org> - 2016-04-06 20:10 +0200

csiph-web