3 ms·

So basically it is the problem with CFG (exploit protection) which is not ready for the cases when there are many allocations and freeing of excutable memory bl

So basically it is the problem with CFG (exploit protection) which is not ready for the cases when there are many allocations and freeing of excutable memory blocks.

brucedawson 8y ago
Yes
- codedokode 8y ago
  Maybe it is better to disable CFG then. Because now it makes a memory leak.
  - brucedawson 8y ago
    That was considered (see the discussion in the bug) but the v8 fix will also fix the memory leak, while still retaining the security value in CFG
Someone1234 8y ago
Kinda; mainly that NtQueryVirtualMemory was super slow when scanning over CFG, which was bug fixed in the April 2018 Windows 10 update. It also uncovered a "bug" (performance weakness?) in v8 that they were able to fix so less CFG blocks were allocated. So kind of a win/win in the end, bugs fixed, world a slightly better place.
- rasz 8y ago
  It didnt strike me as a bug, but a Windows brokeness workaround (windows doesnt release allocations).
- masklinn 8y ago
  > It also uncovered a "bug" (performance weakness?) in v8 that they were able to fix so less CFG blocks were allocated. They implemented a freelist, it's a common workaround for problematic allocators, but has its own issues (https://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse https://www.tedunangst.com/flak/post/analysis-of-openssl-fre...)
  - brucedawson 8y ago
    Normally a freelist is a tradeoff between memory and speed, but in this case there is essentially no tradeoff. If you look at the fix you will see that we don't maintain a freelist of memory in any traditional sense. We just retain a freelist of addresses. These addresses are then used as hints for where to allocate future CodeRange objects. If that address is gone, we'll go somewhere else. Because the memory is fully freed and reallocated this also avoids security concerns.

3 ms·

So basically it is the problem with CFG (exploit protection) which is not ready for the cases when there are many allocations and freeing of excutable memory bl

by codedokode 8y ago

So basically it is the problem with CFG (exploit protection) which is not ready for the cases when there are many allocations and freeing of excutable memory blocks.

brucedawson 8y ago
Yes
- codedokode 8y ago
  Maybe it is better to disable CFG then. Because now it makes a memory leak.
  - brucedawson 8y ago
    That was considered (see the discussion in the bug) but the v8 fix will also fix the memory leak, while still retaining the security value in CFG
Someone1234 8y ago
Kinda; mainly that NtQueryVirtualMemory was super slow when scanning over CFG, which was bug fixed in the April 2018 Windows 10 update. It also uncovered a "bug" (performance weakness?) in v8 that they were able to fix so less CFG blocks were allocated. So kind of a win/win in the end, bugs fixed, world a slightly better place.
- rasz 8y ago
  It didnt strike me as a bug, but a Windows brokeness workaround (windows doesnt release allocations).
- masklinn 8y ago
  > It also uncovered a "bug" (performance weakness?) in v8 that they were able to fix so less CFG blocks were allocated. They implemented a freelist, it's a common workaround for problematic allocators, but has its own issues (https://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse https://www.tedunangst.com/flak/post/analysis-of-openssl-fre...)
  - brucedawson 8y ago
    Normally a freelist is a tradeoff between memory and speed, but in this case there is essentially no tradeoff. If you look at the fix you will see that we don't maintain a freelist of memory in any traditional sense. We just retain a freelist of addresses. These addresses are then used as hints for where to allocate future CodeRange objects. If that address is gone, we'll go somewhere else. Because the memory is fully freed and reallocated this also avoids security concerns.