From: Dan Rosenberg <drosenberg@vsecurity.com>
To: Pekka Enberg <penberg@kernel.org>
Cc: Matt Mackall <mpm@selenic.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Dave Hansen <dave@linux.vnet.ibm.com>,
Theodore Tso <tytso@mit.edu>,
cl@linux-foundation.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, Ingo Molnar <mingo@elte.hu>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH] Make /proc/slabinfo 0400
Date: Fri, 04 Mar 2011 16:10:34 -0500 [thread overview]
Message-ID: <1299273034.2071.1417.camel@dan> (raw)
In-Reply-To: <AANLkTimvhHxsMCf2FX0O8VqksOa2EAMz=S_C3LQKvE60@mail.gmail.com>
On Fri, 2011-03-04 at 22:58 +0200, Pekka Enberg wrote:
> On Fri, Mar 4, 2011 at 10:37 PM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> > This patch makes these techniques more difficult by making it hard to
> > know whether the last attacker-allocated object resides before a free or
> > allocated object. Especially with vulnerabilities that only allow one
> > attempt at exploitation before recovery is needed to avoid trashing too
> > much heap state and causing a crash, this could go a long way. I'd
> > still argue in favor of removing the ability to know how many objects
> > are used in a given slab, since randomizing objects doesn't help if you
> > know every object is allocated.
>
> So if the attacker knows every object is allocated, how does that help
> if we're randomizing the initial freelist?
If you know you've got a slab completely full of your objects, then it
doesn't matter that they happened to be allocated in a random fashion -
they're still all allocated, and by freeing one of them and
reallocating, you'll still be next to your target.
WARNING: multiple messages have this Message-ID (diff)
From: Dan Rosenberg <drosenberg@vsecurity.com>
To: Pekka Enberg <penberg@kernel.org>
Cc: Matt Mackall <mpm@selenic.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Dave Hansen <dave@linux.vnet.ibm.com>,
Theodore Tso <tytso@mit.edu>,
cl@linux-foundation.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, Ingo Molnar <mingo@elte.hu>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH] Make /proc/slabinfo 0400
Date: Fri, 04 Mar 2011 16:10:34 -0500 [thread overview]
Message-ID: <1299273034.2071.1417.camel@dan> (raw)
In-Reply-To: <AANLkTimvhHxsMCf2FX0O8VqksOa2EAMz=S_C3LQKvE60@mail.gmail.com>
On Fri, 2011-03-04 at 22:58 +0200, Pekka Enberg wrote:
> On Fri, Mar 4, 2011 at 10:37 PM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> > This patch makes these techniques more difficult by making it hard to
> > know whether the last attacker-allocated object resides before a free or
> > allocated object. Especially with vulnerabilities that only allow one
> > attempt at exploitation before recovery is needed to avoid trashing too
> > much heap state and causing a crash, this could go a long way. I'd
> > still argue in favor of removing the ability to know how many objects
> > are used in a given slab, since randomizing objects doesn't help if you
> > know every object is allocated.
>
> So if the attacker knows every object is allocated, how does that help
> if we're randomizing the initial freelist?
If you know you've got a slab completely full of your objects, then it
doesn't matter that they happened to be allocated in a random fashion -
they're still all allocated, and by freeing one of them and
reallocating, you'll still be next to your target.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2011-03-04 21:10 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-03 17:50 [PATCH] Make /proc/slabinfo 0400 Dan Rosenberg
2011-03-03 17:50 ` Dan Rosenberg
2011-03-03 18:17 ` Dave Hansen
2011-03-03 18:17 ` Dave Hansen
2011-03-03 18:29 ` Dan Rosenberg
2011-03-03 18:29 ` Dan Rosenberg
2011-03-03 20:58 ` Matt Mackall
2011-03-03 20:58 ` Matt Mackall
2011-03-03 21:16 ` Dan Rosenberg
2011-03-03 21:16 ` Dan Rosenberg
2011-03-03 21:44 ` Matt Mackall
2011-03-03 21:44 ` Matt Mackall
2011-03-03 22:30 ` Dan Rosenberg
2011-03-03 22:30 ` Dan Rosenberg
2011-03-03 23:08 ` Matt Mackall
2011-03-03 23:08 ` Matt Mackall
2011-03-04 0:32 ` Dave Hansen
2011-03-04 0:32 ` Dave Hansen
2011-03-04 0:50 ` Theodore Tso
2011-03-04 0:50 ` Theodore Tso
2011-03-04 6:52 ` Pekka Enberg
2011-03-04 6:52 ` Pekka Enberg
2011-03-04 17:36 ` Dave Hansen
2011-03-04 17:36 ` Dave Hansen
2011-03-04 17:48 ` Linus Torvalds
2011-03-04 17:48 ` Linus Torvalds
2011-03-04 18:14 ` Matt Mackall
2011-03-04 18:14 ` Matt Mackall
2011-03-04 20:02 ` Pekka Enberg
2011-03-04 20:31 ` Matt Mackall
2011-03-04 20:31 ` Matt Mackall
2011-03-04 20:42 ` Dan Rosenberg
2011-03-04 20:42 ` Dan Rosenberg
2011-03-04 20:56 ` Pekka Enberg
2011-03-04 20:56 ` Pekka Enberg
2011-03-04 21:08 ` Dan Rosenberg
2011-03-04 21:08 ` Dan Rosenberg
2011-03-04 21:30 ` Pekka Enberg
2011-03-04 21:30 ` Pekka Enberg
2011-03-04 21:44 ` Dan Rosenberg
2011-03-04 21:44 ` Dan Rosenberg
2011-03-04 22:10 ` Pekka Enberg
2011-03-04 22:10 ` Pekka Enberg
2011-03-04 22:14 ` Pekka Enberg
2011-03-04 22:14 ` Pekka Enberg
2011-03-04 23:02 ` Matt Mackall
2011-03-04 23:02 ` Matt Mackall
2011-03-05 16:25 ` Ted Ts'o
2011-03-05 16:25 ` Ted Ts'o
2011-03-06 13:19 ` Alan Cox
2011-03-06 13:19 ` Alan Cox
2011-03-07 14:56 ` Dan Rosenberg
2011-03-07 14:56 ` Dan Rosenberg
2011-03-07 16:02 ` Matt Mackall
2011-03-07 16:02 ` Matt Mackall
2011-03-04 20:37 ` Dan Rosenberg
2011-03-04 20:37 ` Dan Rosenberg
2011-03-04 20:58 ` Pekka Enberg
2011-03-04 20:58 ` Pekka Enberg
2011-03-04 21:10 ` Dan Rosenberg [this message]
2011-03-04 21:10 ` Dan Rosenberg
2011-03-06 0:42 ` Jesper Juhl
2011-03-06 0:42 ` Jesper Juhl
2011-03-06 0:57 ` Dan Rosenberg
2011-03-06 0:57 ` Dan Rosenberg
2011-03-06 1:09 ` Matt Mackall
2011-03-06 1:09 ` Matt Mackall
2011-03-06 1:15 ` Jesper Juhl
2011-03-06 1:15 ` Jesper Juhl
2011-03-07 16:40 ` Christoph Lameter
2011-03-07 16:40 ` Christoph Lameter
2011-03-04 21:12 ` Matt Mackall
2011-03-04 21:12 ` Matt Mackall
2011-03-04 11:58 ` Alan Cox
2011-03-04 11:58 ` Alan Cox
-- strict thread matches above, loose matches on Subject: below --
2011-03-07 14:19 [PATCH] Make /proc/slabinfo 040 George Spelvin
2011-03-07 17:49 ` [PATCH] Make /proc/slabinfo 0400 George Spelvin
2011-03-07 17:49 ` George Spelvin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1299273034.2071.1417.camel@dan \
--to=drosenberg@vsecurity.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux-foundation.org \
--cc=dave@linux.vnet.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mingo@elte.hu \
--cc=mpm@selenic.com \
--cc=penberg@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.