Re: [PATCH] Make /proc/slabinfo 0400

[Dan Rosenberg <drosenberg@vsecurity.com>]

On Fri, 2011-03-04 at 23:30 +0200, Pekka Enberg wrote:
> Right. So you fill a slab with objects A that you want to overflow
> (struct shmid_kernel in the example exploit) then free one of them,
> allocate object B, smash it (and the next object), and find the
> smashed object A.
> 
> But doesn't that make the whole /slab/procinfo discussion moot? You
> can always use brute force to allocate N objects (where N is larger
> than max objects in a slab) and then just free nth object that's most
> likely to land on the slab you have full control over (as explained by
> Matt).
> 
>                         Pekka 

This is a good point, and one that I've come to accept as a result of
having this conversation.  Consider the patch dropped, unless there are
other reasons I've missed.  I still think it's worth brainstorming
techniques for hardening the kernel heap in ways that don't create
performance impact, but I admit that the presence or absence of this
debugging information isn't a crucial factor in successful exploitation.

Thanks,
Dan