Re: Vulnerability in Software Suspend 2 (all versions)

[Nigel Cunningham <ncunningham@crca.org.au>]

Hi again.

On Mon, 2008-07-28 at 14:20 +0530, Jonathan Brossard wrote:
> Dear Nigel,
> 
> >This is not a bug in TuxOnIce (or for that matter other Linux
> >hibernation implementations, which would have the same issue).
> 
> Yes it is.
> 
> >TuxOnIce has no way to know what running applications have passwords
> >stored in memory or whether they are storing them in an encrypted format
> >or not. Bugs should be filed against applications that are storing
> >passwords in plain text.
> 
> We are talking about the password of tuxonice itself here...

TuxOnIce itself doesn't have any password support. Do you mean a
password for encrypted swap or such like?

> Please boot a computer using tuxonice, go for hibernation,
> reboot, and then type this (as root) :
> 
> xxd -l 32 -s 0x041e  /dev/mem
> 
> 
> >By the way, these contact email addresses are grossly out of date. For
> >TuxOnIce, the contact is nigel@tuxonice.net. For swsusp and uswsusp
> >(which would have the same problem), refer to linux-pm@lists.osdl.org.
> 
> I did my best to find one on the site's website and ended up
> taking those of sourceforge.

Hmm, you're right there. I'll address that shortly.

Regards,

Nigel