3 ms·
I see that the two they fixed disclosed more memory than expected - but is that enough reason to fix it? It seems like you’d probably want a complete POC before
by sqldba 9y ago
I see that the two they fixed disclosed more memory than expected - but is that enough reason to fix it? It seems like you’d probably want a complete POC before fixing them. Or are there common POCs that these obviously fall into?
- bonzini 9y agoKernel memory disclosure pretty much always provides an easy way to bypass kernel address randomization (KASLR).
- tankenmate 9y agoFor those not fully aware of why; if you can get a copy of a section of the kernel stack (which should have been zeroed but wasn't) you'll get the kernel memory (which is different from user memory) addresses of function calls, data structures, etc which then allow you target where to insert your own code / data. In other words it allows you to accurately hijack kernel functions and/or compromise kernel data structures, e.g. change the owner of a kernel object, process or task. It's half of what you need to compromise the kernel (you now know where to inject code/data). The other is having a way to inject code/data. EDIT - grammar fix.
- chris_wot 9y agoI'm still trying to work out when they fixed this: https://bugs.documentfoundation.org/show_bug.cgi?id=62764 https://bugs.documentfoundation.org/show_bug.cgi?id=62764 They got memory dumps from me, but never got back to me about it. It was incredibly poor form, I literally rebuilt systems from scratch to get them the memory dumps, and they never even told me if it helped. Pretty shitty really. I found a nasty issue, and all I wanted was to know if they were going to fix it. Hell, I didn't even want credit - just knowing it was fixed would have been great.
- bonzini 9y agoThey probably didn't even realize they were fixing it. That happens sometimes.