What to do in response to a kernel warning
What to do in response to a kernel warning
Posted Nov 18, 2021 22:53 UTC (Thu) by a13xp0p0v (guest, #118926)In reply to: What to do in response to a kernel warning by NYKevin
Parent article: What to do in response to a kernel warning
In theory, the userspace should be adapted to this kernel behavior.
In practice, currently, the Linux kernel kills processes on oops. OOM killer kills processes. grsecurity also kills processes.
pkill_on_warn is simply stopping the process when the first signs of wrong behavior are detected. That complies with the Fail-Fast principle.
Bugs usually don't come alone, and a kernel warning may be followed by memory corruption or other negative effects. Real example:
https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
pkill_on_warn would prevent this kernel vulnerability exploit.
It would also make kernel warning infoleaks less valuable for the attacker. Exploit examples using such infoleaks:
https://googleprojectzero.blogspot.com/2018/09/a-cache-in...
https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html
Anyway, this patch provoked a deep discussion.
Maybe one day, the Linux kernel will get a more consistent error handling policy.