8 ms·

Are all BSDs created equally? A survey of BSD kernel vulnerabilities [video]

147 points by teamhappy 9y ago

mrtweetyhack 9y ago
Who uses BSD?
na85 9y ago
Anyone have a text mode summary?
- throwaway2048 9y ago
  It is the same presentation he gave earlier in the year https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre...
  - jwilk 9y ago
    The server times out for me: $ wget --timeout=60 https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf --2017-12-31 17:15:23-- https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf Resolving media.defcon.org (media.defcon.org)... 162.222.171.207 Connecting to media.defcon.org (media.defcon.org)|162.222.171.207|:443... connected. Unable to establish SSL connection.
- teamhappy 9y ago
  Link to the current slides: https://fahrplan.events.ccc.de/congress/2017/Fahrplan/system/event_attachments/attachments/000/003/262/original/bsd_kern_vulns.pptx https://fahrplan.events.ccc.de/congress/2017/Fahrplan/system...
  - na85 9y ago
    Thanks!
feelin_googley 9y ago
Toward the end he suggests NetBSD "dropped the ball" by not issuing patches and reports. I am not sure about others but I have never considered what is reported at http://www.netbsd.org/support/security/ http://www.netbsd.org/support/security/ as comprehensive. I like to think the majority of NetBSD users either track -current, compile their own custom kernels or can learn to do as much. The project certainly makes it easy enough. The flipside of the "many eyes" argument is that the Linux kernel has substantial financial backing and teams of paid developers behind it. NetBSD is relatively small and most contributors are not paid. I think they do an admirable job considering the number of active contributors and maintainers they have. (That is really an understatement but I do not want to appear too biased.) This is not the first time I have seen them immediately fix stuff when it is reported1. 1 http://bulk.fefe.de/scalability/ http://bulk.fefe.de/scalability/ Unfortunately, even though the presenter mentioned loc several times, he did not try to calculate a bugs:loc ratio. Having a highly educational "history of BSD UNIX" and a large quantity of source code that allows hobbyists to run old hardware in their tree makes NetBSD not only unique and useful but also an easy target for any contemporary security researcher. I only wish more would take on the challenge. Because sometimes things get fixed fast when this happens. But comparing one project that has SVR4 compatibilty code to another project that has no such compat code, is that really an apt comparison? The old code is there for a reason. IMO, it does not imply many users will ever need it, that every user is actively using it, or that any user should have it in their kernel if they do not need it. It is very easy for NetBSD users to compile kernels without code that will not be used, e.g., compatibility code. Easier than in any other OS I have tried. IMO, by making custom kernels so effortless to create (incl. best cross-compilation experience, IMO), it encourages users to compile smaller kernels without the drivers, compat code and other stuff they do not need. But the presenter here was focused only on the assumption of a "default" kernel config. Not the potential to create small custom kernels with minimal attack surface. Also: When the presenter was discussing filesystems, I wondered if he knew about rump. I think NetBSD was the first to have a such an innovative, safe way to mount filesystems using kernel drivers in userspace, without risk of crashing the kernel.
- throwaway2048 9y ago
  Defaults matter immensely for two reasons: very few people ever bother to change them unless a specific, user visible problem is occuring due to the first point, non-defaults receive little or no testing, and are highly likely to be broken, and stay broken because the catch 22 of nobody cares so its broken, and because its broken nobody cares. Off by default is very much the status of mitigation technologies in FreeBSD atm, its a shame that the author did not touch on this as its one area OpenBSD is miles ahead of FreeBSD in particular (mitigations on by default, breakage exposed and fixed due to it, they remain mostly unusable on FreeBSD due to them).
subsubsub 9y ago
Please can someone give a brief summary of the conclusions of this talk for those of use that don't have the time and/or bandwidth to watch this? Thanks.
- teamhappy 9y ago
  Linux has more CVEs than the BSDs. Ilja wanted to know if that's because they have less bugs/better code or because more people have read the Linux code. Turns out the BSDs have just as many bugs as Linux. (He found dozens over the course of 3 months.) OpenBSD has less bugs than FreeBSD (presumably because they have removed a lot of old code) and FreeBSD has less bugs than NetBSD. After reporting the bugs he noticed that OpenBSD handles bugs really well, NetBSD less well and FreeBSD in many cases not at all. (By handling the bugs I mean fixing them in current and providing patches/advisories for the latest release.)
  - subsubsub 9y ago
    Thanks for taking the time. Happy New Year!
  - ianai 9y ago
    Why doesn’t FreeBSD address them?
    - teamhappy 9y ago
      No idea. He didn't mention anything during the talk (I haven't seen the QA at the end). He said he reported them a few months back and checked if they were fixed a few days before congress. 3 were fixed, the other ~20 weren't.
tachion 9y ago
While you're here, have you donated[0][1] yet? :) You may or may not be aware, but FreeBSD runs your movies on Netflix, your games on PlayStation, your files on FreeNAS and ZFS, your friends on WhatsApp and OpenBSD runs everywhere else as OpenSSH. ;) So, you may or may not know that, but you need FreeBSD and OpenBSD and they also need you! Every cent counts and so does every contributor, that helps the foundations keep their non-profit status. Also, you CAN be the change, if you specify what you'd like your donation to be used for (like more secure defaults for the OS or towards code review and bugs fixing). [0]https://www.freebsdfoundation.org/donate/ https://www.freebsdfoundation.org/donate/ [1]https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html
- Strom 9y ago
  Surely there are better reasons to donate to these projects other than funding development for massive corporations like Netflix, Sony, and Facebook. The idea that my donation money will be primarily used to cut costs for these corporations isn't exactly appealing to me.
  - tachion 9y ago
    You might one day want to run a startup or a project and then you could just do it on FreeBSD in any way you like, given the permissive license and this is exactly the reason why you need BSD, not only because Netflix, Sony or WhatsApp uses them to serve you their service. Does it really bother you that much if your $10 of donation will benefit yourself, myself, other ordinary people and some companies at the same time, enough to stop you from donating? I personally can't understand that, because when I donate my money or my code, it's yours then and you're free to do with it as you please, and wether you make $1000000 off it or not, it's not my concern anymore.
    - Strom 9y ago
      No it doesn't bother me if others (including big corporations) benefit as well, if I'm doing the donation anyway. I'll probably view it as a bonus! It's just that the benefit to big corporations alone isn't a motivator for me to donate in the first place. The idea that at some point in the future I might want to use FreeBSD is definitely a better motivator. However this same argument applies to a million other projects that are in need of donations. My donation fund is limited, and so arguments that apply to pretty much every project don't make these BSD projects stand out. In practice there are projects which I'm already actively using, and they get the majority of my donations. However I do occasionally donate to projects with future potential that I haven't benefited from yet. I'm not against donating, even to projects which I don't directly use. I'm just saying that the fund raising pitch here is very weak. Not to belittle the BSD projects, but to point out that the situation can be greatly improved. Although yes I also understand that most open source project people want to work on their personal pet features and not deal with things like marketing, sales, image building.
Polyisoprene 9y ago
Apparently no amount of coding standards, reviewing or number of contributors make up for the huge deficiencies of using C. Wondering what the state of open source operating systems would be if they didn’t have to fight the programming language.
- sureaboutthis 9y ago
  Consider that virtually all well-known operating systems, device drivers, embedded systems all over the world use C for some reason, what are you saying would be a better choice?
  - mrd999 9y ago
    rust
    - sureaboutthis 9y ago
      I looked into rust when it first came out. I dissed it but then found it to be quite interesting. However, compared to C, it is used relatively nowhere by anyone. I don't believe rust has proved to be a non-hesitant replacement for C.
- sebcat 9y ago
  Which tells me that 1) the deficiencies are minor or 2) the benefits outweigh the deficiencies, or a combination.
- JoachimSchipper 9y ago
  Writing in another language doesn't come close to solving the problem - a modern OS sits between lots of differently-privileged processes and thousands of devices, most of which have DMA access to host memory (and which are thus "memory-unsafe" in any language). On the other hand, C does give you good low-level access, an enormous ecosystem, and a large number of potential contributors. HN is fond of blaming C, but seldom has any awareness of why almost everything does use C. This is not to say that C is perfect, but replacing it needs deep expertise in the fields in which C is still dominant.
vermaden 9y ago
Pity they havent included HardenedBSD into the list ...

147 points by teamhappy 9y ago

mrtweetyhack 9y ago

Who uses BSD?

na85 9y ago

Anyone have a text mode summary?

throwaway2048 9y ago
It is the same presentation he gave earlier in the year https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre...
- jwilk 9y ago
  The server times out for me: $ wget --timeout=60 https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf --2017-12-31 17:15:23-- https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Ilja-van-Sprundel-BSD-Kern-Vulns.pdf Resolving media.defcon.org (media.defcon.org)... 162.222.171.207 Connecting to media.defcon.org (media.defcon.org)|162.222.171.207|:443... connected. Unable to establish SSL connection.
teamhappy 9y ago
Link to the current slides: https://fahrplan.events.ccc.de/congress/2017/Fahrplan/system/event_attachments/attachments/000/003/262/original/bsd_kern_vulns.pptx https://fahrplan.events.ccc.de/congress/2017/Fahrplan/system...
- na85 9y ago
  Thanks!

feelin_googley 9y ago

Toward the end he suggests NetBSD "dropped the ball" by not issuing patches and reports. I am not sure about others but I have never considered what is reported at http://www.netbsd.org/support/security/ http://www.netbsd.org/support/security/ as comprehensive. I like to think the majority of NetBSD users either track -current, compile their own custom kernels or can learn to do as much. The project certainly makes it easy enough. The flipside of the "many eyes" argument is that the Linux kernel has substantial financial backing and teams of paid developers behind it. NetBSD is relatively small and most contributors are not paid. I think they do an admirable job considering the number of active contributors and maintainers they have. (That is really an understatement but I do not want to appear too biased.) This is not the first time I have seen them immediately fix stuff when it is reported1. 1 http://bulk.fefe.de/scalability/ http://bulk.fefe.de/scalability/ Unfortunately, even though the presenter mentioned loc several times, he did not try to calculate a bugs:loc ratio. Having a highly educational "history of BSD UNIX" and a large quantity of source code that allows hobbyists to run old hardware in their tree makes NetBSD not only unique and useful but also an easy target for any contemporary security researcher. I only wish more would take on the challenge. Because sometimes things get fixed fast when this happens. But comparing one project that has SVR4 compatibilty code to another project that has no such compat code, is that really an apt comparison? The old code is there for a reason. IMO, it does not imply many users will ever need it, that every user is actively using it, or that any user should have it in their kernel if they do not need it. It is very easy for NetBSD users to compile kernels without code that will not be used, e.g., compatibility code. Easier than in any other OS I have tried. IMO, by making custom kernels so effortless to create (incl. best cross-compilation experience, IMO), it encourages users to compile smaller kernels without the drivers, compat code and other stuff they do not need. But the presenter here was focused only on the assumption of a "default" kernel config. Not the potential to create small custom kernels with minimal attack surface. Also: When the presenter was discussing filesystems, I wondered if he knew about rump. I think NetBSD was the first to have a such an innovative, safe way to mount filesystems using kernel drivers in userspace, without risk of crashing the kernel.

throwaway2048 9y ago
Defaults matter immensely for two reasons: very few people ever bother to change them unless a specific, user visible problem is occuring due to the first point, non-defaults receive little or no testing, and are highly likely to be broken, and stay broken because the catch 22 of nobody cares so its broken, and because its broken nobody cares. Off by default is very much the status of mitigation technologies in FreeBSD atm, its a shame that the author did not touch on this as its one area OpenBSD is miles ahead of FreeBSD in particular (mitigations on by default, breakage exposed and fixed due to it, they remain mostly unusable on FreeBSD due to them).

subsubsub 9y ago

Please can someone give a brief summary of the conclusions of this talk for those of use that don't have the time and/or bandwidth to watch this? Thanks.

teamhappy 9y ago
Linux has more CVEs than the BSDs. Ilja wanted to know if that's because they have less bugs/better code or because more people have read the Linux code. Turns out the BSDs have just as many bugs as Linux. (He found dozens over the course of 3 months.) OpenBSD has less bugs than FreeBSD (presumably because they have removed a lot of old code) and FreeBSD has less bugs than NetBSD. After reporting the bugs he noticed that OpenBSD handles bugs really well, NetBSD less well and FreeBSD in many cases not at all. (By handling the bugs I mean fixing them in current and providing patches/advisories for the latest release.)
- subsubsub 9y ago
  Thanks for taking the time. Happy New Year!
- ianai 9y ago
  Why doesn’t FreeBSD address them?
  - teamhappy 9y ago
    No idea. He didn't mention anything during the talk (I haven't seen the QA at the end). He said he reported them a few months back and checked if they were fixed a few days before congress. 3 were fixed, the other ~20 weren't.

tachion 9y ago

While you're here, have you donated[0][1] yet? :) You may or may not be aware, but FreeBSD runs your movies on Netflix, your games on PlayStation, your files on FreeNAS and ZFS, your friends on WhatsApp and OpenBSD runs everywhere else as OpenSSH. ;) So, you may or may not know that, but you need FreeBSD and OpenBSD and they also need you! Every cent counts and so does every contributor, that helps the foundations keep their non-profit status. Also, you CAN be the change, if you specify what you'd like your donation to be used for (like more secure defaults for the OS or towards code review and bugs fixing). [0]https://www.freebsdfoundation.org/donate/ https://www.freebsdfoundation.org/donate/ [1]https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html

Strom 9y ago
Surely there are better reasons to donate to these projects other than funding development for massive corporations like Netflix, Sony, and Facebook. The idea that my donation money will be primarily used to cut costs for these corporations isn't exactly appealing to me.
- tachion 9y ago
  You might one day want to run a startup or a project and then you could just do it on FreeBSD in any way you like, given the permissive license and this is exactly the reason why you need BSD, not only because Netflix, Sony or WhatsApp uses them to serve you their service. Does it really bother you that much if your $10 of donation will benefit yourself, myself, other ordinary people and some companies at the same time, enough to stop you from donating? I personally can't understand that, because when I donate my money or my code, it's yours then and you're free to do with it as you please, and wether you make $1000000 off it or not, it's not my concern anymore.
  - Strom 9y ago
    No it doesn't bother me if others (including big corporations) benefit as well, if I'm doing the donation anyway. I'll probably view it as a bonus! It's just that the benefit to big corporations alone isn't a motivator for me to donate in the first place. The idea that at some point in the future I might want to use FreeBSD is definitely a better motivator. However this same argument applies to a million other projects that are in need of donations. My donation fund is limited, and so arguments that apply to pretty much every project don't make these BSD projects stand out. In practice there are projects which I'm already actively using, and they get the majority of my donations. However I do occasionally donate to projects with future potential that I haven't benefited from yet. I'm not against donating, even to projects which I don't directly use. I'm just saying that the fund raising pitch here is very weak. Not to belittle the BSD projects, but to point out that the situation can be greatly improved. Although yes I also understand that most open source project people want to work on their personal pet features and not deal with things like marketing, sales, image building.

Polyisoprene 9y ago

Apparently no amount of coding standards, reviewing or number of contributors make up for the huge deficiencies of using C. Wondering what the state of open source operating systems would be if they didn’t have to fight the programming language.

sureaboutthis 9y ago
Consider that virtually all well-known operating systems, device drivers, embedded systems all over the world use C for some reason, what are you saying would be a better choice?
- mrd999 9y ago
  rust
  - sureaboutthis 9y ago
    I looked into rust when it first came out. I dissed it but then found it to be quite interesting. However, compared to C, it is used relatively nowhere by anyone. I don't believe rust has proved to be a non-hesitant replacement for C.
sebcat 9y ago
Which tells me that 1) the deficiencies are minor or 2) the benefits outweigh the deficiencies, or a combination.
JoachimSchipper 9y ago
Writing in another language doesn't come close to solving the problem - a modern OS sits between lots of differently-privileged processes and thousands of devices, most of which have DMA access to host memory (and which are thus "memory-unsafe" in any language). On the other hand, C does give you good low-level access, an enormous ecosystem, and a large number of potential contributors. HN is fond of blaming C, but seldom has any awareness of why almost everything does use C. This is not to say that C is perfect, but replacing it needs deep expertise in the fields in which C is still dominant.

vermaden 9y ago

Pity they havent included HardenedBSD into the list ...