LWN: Comments on "Linux ASLR vulnerabilities"

Linux ASLR vulnerabilities

jamesmrh — 2009-05-03T23:12:01+00:00

I can't see if there's any CC's on that email, but I suggest making sure it's cc'd to the LSM list, as well as known x86/platform experts such as Arjan, Ingo, Alan Cox, Roland McGrath etc.

(I didn't even know that'd been posted until I read this thread on LWN).

Linux ASLR vulnerabilities

willezurmacht — 2009-05-02T13:54:57+00:00

CC the -mm maintainer if you don't get lucky in the second chance. Sometimes it helps.

Linux ASLR vulnerabilities

jake — 2009-05-02T13:39:08+00:00

> Are you aware of any progress in getting the vulnerability fixed?

Nope. I will resend the patch in a day or two if I don't hear anything.

jake

Linux ASLR vulnerabilities

willezurmacht — 2009-05-02T13:15:38+00:00

The problem with blacklisting is that you never know when your blacklist is enough. The question is if there are any true legitimate uses of this and what's specifically required.

Either way, there are plenty of other methods to get around the difficulties presented by ASLR as of its current implementation in mainline kernel.

I would like to know if Jake's patch goes through, hopefully it does.

Linux ASLR vulnerabilities

spender — 2009-05-02T01:37:57+00:00

Hi Jake,

I noticed you submitted the following patch to LKML earlier this week:
http://lkml.org/lkml/2009/4/30/265?h1=4d3afeb44daf01af97a...

but it hasn't received any responses yet, and I haven't seen any patches submitted by anyone else. Are you aware of any progress in getting the vulnerability fixed?

-Brad

Linux ASLR vulnerabilities

nix — 2009-04-30T16:34:39+00:00

Oh that first one is quite nasty. We can stop reporting wchan for non-self users when non-root without breaking too much, but doing the same for /proc/*/stat is out of the question. Perhaps we can blank out just the sensitive fields in such cases?

Linux ASLR vulnerabilities

njd27 — 2009-04-30T10:46:47+00:00

Nonsense, the important question is, should the singular of "jiffies" be "jiffie" or "jiffy"?

Linux ASLR vulnerabilities

jreiser — 2009-04-30T02:32:07+00:00

it would be a tragedy to think that known vulnerabilities are just falling through the cracks

Oh, stop being so melodramatic. It's not a tragedy. It's money being made by those who look and listen carefully, widely, and with patience. It was ever thus. The important questions are the quantifiers: "How much money, how often, by whom, ...?"