[kernel-hardening] For whoever's looking at memory santizing..

[kernel-hardening] For whoever's looking at memory santizing..

[Valdis Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 284 bytes --]

If you need a real-life example of why we should be doing it consistently:

http://venturebeat.com/2016/01/13/nvidia-blames-apple-for-bug-that-exposes-porn-browsing-in-chromes-incognito-mode/

(Not taking sides on who failed to do it in this case - obviously *somebody* has ti do it)

[-- Attachment #2: Type: application/pgp-signature, Size: 848 bytes --]

Re: [kernel-hardening] For whoever's looking at memory santizing..

[Hanno Böck]

[-- Attachment #1: Type: text/plain, Size: 559 bytes --]

On Thu, 14 Jan 2016 18:11:09 -0500
Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:

> If you need a real-life example of why we should be doing it
> consistently:
> 
> http://venturebeat.com/2016/01/13/nvidia-blames-apple-for-bug-that-exposes-porn-browsing-in-chromes-incognito-mode/

This article seems to be only about OS X.

I hope it's no secret that this is a problem on Linux as well:
https://hsmr.cc/palinopsia/

And from all I'm aware it's unfixed.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: BBB51E42

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [kernel-hardening] For whoever's looking at memory santizing..

[Kees Cook]

On Thu, Jan 14, 2016 at 4:36 PM, Hanno Böck <hanno@hboeck.de> wrote:
> On Thu, 14 Jan 2016 18:11:09 -0500
> Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:
>
>> If you need a real-life example of why we should be doing it
>> consistently:
>>
>> http://venturebeat.com/2016/01/13/nvidia-blames-apple-for-bug-that-exposes-porn-browsing-in-chromes-incognito-mode/
>
> This article seems to be only about OS X.
>
> I hope it's no secret that this is a problem on Linux as well:
> https://hsmr.cc/palinopsia/
>
> And from all I'm aware it's unfixed.

I'm curious if this is fixable from the DRM layer, or if it's strictly
driver-specific. Casey, could you bounce this toward some of the Intel
graphics folks? While Intel isn't called out, I'm curious if there is
still something that could be done in the general case...

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security

RE: [kernel-hardening] For whoever's looking at memory santizing..

[Schaufler, Casey]

> -----Original Message-----
> From: keescook@google.com [mailto:keescook@google.com] On Behalf Of
> Kees Cook
> Sent: Tuesday, January 19, 2016 9:24 AM
> To: Schaufler, Casey <casey.schaufler@intel.com>
> Cc: kernel-hardening@lists.openwall.com
> Subject: Re: [kernel-hardening] For whoever's looking at memory santizing..
> 
> On Thu, Jan 14, 2016 at 4:36 PM, Hanno Böck <hanno@hboeck.de> wrote:
> > On Thu, 14 Jan 2016 18:11:09 -0500
> > Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:
> >
> >> If you need a real-life example of why we should be doing it
> >> consistently:
> >>
> >> http://venturebeat.com/2016/01/13/nvidia-blames-apple-for-bug-that-
> exposes-porn-browsing-in-chromes-incognito-mode/
> >
> > This article seems to be only about OS X.
> >
> > I hope it's no secret that this is a problem on Linux as well:
> > https://hsmr.cc/palinopsia/
> >
> > And from all I'm aware it's unfixed.
> 
> I'm curious if this is fixable from the DRM layer, or if it's strictly
> driver-specific. Casey, could you bounce this toward some of the Intel
> graphics folks? While Intel isn't called out, I'm curious if there is
> still something that could be done in the general case...

The Intel graphics drivers (so I'm told) use memory allocated
in the shmem layer, and hence can count on it being cleared.
I don't know if that approach can be generalized, or if it would
even be possible for other drivers.

> -Kees
> 
> --
> Kees Cook
> Chrome OS & Brillo Security