5 ms·

I think this needs some important context, because otherwise it may be read as "Linux is so insecure compared to the other OSes". From the screenshot it seems

by hannob 6y ago

I think this needs some important context, because otherwise it may be read as "Linux is so insecure compared to the other OSes". From the screenshot it seems all of the bugs were found with KASAN and most of them were overread bugs. Likely for the other OSes they were only looking for crashes and probably often missed these classes of bugs that KASAN can uncover. This essentially means they found more bugs in Linux because Linux has better tools to uncover subtle memory safety bugs.

frank2 6y ago
KASAN is a kernel address sanitizer. Is your claim that the other OSes, as tested, do not do address sanitization?
- johnnyapol 6y ago
  I think their claim is the researchers can run a Linux install with KASAN and see the results but they are unable to use an equivalent of that on MacOSX, Windows as Apple, Microsoft do not allow an end-user to perform that kind of instrumentation on their own device.
  - frank2 6y ago
    You and the person I replied to above are essentially correct: >Fuzzing drivers on [FreeBSD, MacOS, and Windows] is more challenging than the Linux kernel due to the lack of support infrastructure. These OSes support neither KASAN, other sanitizers, nor coverage-based collection of executions. The lack of a memory-based sanitizer means our fuzzer only discovers bugs that trigger exceptions, and misses all bugs that silently corrupt memory. Because we cannot collect coverage information, our fuzzer cannot detect seeds that trigger new inputs. (https://nebelwelt.net/files/20SEC3.pdf https://nebelwelt.net/files/20SEC3.pdf) The researchers employed a partial workaround for the problem, but it is pretty obvious to me that the partial workaround does not level the playing field: >To alleviate the second concern, the lack of coverage-guided optimization, we experiment with cross-pollination. To seed our dumb fuzzer, we reuse the inputs generated during our Linux kernel fuzzing campaign.
    - zxombie 6y ago
      They are only partially correct about FreeBSD. In FreeBSD 12 there is no coverage sanitizer as it was added to 13 and never merged to 12. Support for KASAN, and the other sanitizers is in development, however I'm currently too busy working on other things to have time to finish it.
    - my123 6y ago
      XNU definitely supports kasan on macOS, since quite some years. (however, kasan kernels aren't shipped by default, you can build from source though) However, no idea if Kernel Debug Kit ships with prebuilt kasan kernel and drivers.
      - saagarjha 6y ago
        I see a kernel.kasan inside the latest KDK. Doubt this extends to drivers, as all I can find for those are debug symbols.
muststopmyths 6y ago
>This essentially means they found more bugs in Linux because Linux has better tools to uncover subtle memory safety bugs. Driver verifier has been part of Windows for 20+ years and detects memory overflows, underflows, use after free and whole bunch of other bad driver behavior specific to the Windows driver model. I don't see any evidence in the paper that the authors knew about it, so it's possible more bugs can be found that way in Windows using their fuzzing tools
jmeyer2k 6y ago
Instrumentation is huge too... I had a bug with the webcam on my Razer Blade which I was able to fix on Linux because it was open-source. It was a pretty simple patch and I submitted it as a patch to Linux. I had a bug with USB devices on my Mac and I had to go back and forth with Apple support for 2 weeks and ended up returning the device.

by hannob 6y ago

frank2 6y ago

KASAN is a kernel address sanitizer. Is your claim that the other OSes, as tested, do not do address sanitization?

johnnyapol 6y ago
I think their claim is the researchers can run a Linux install with KASAN and see the results but they are unable to use an equivalent of that on MacOSX, Windows as Apple, Microsoft do not allow an end-user to perform that kind of instrumentation on their own device.
- frank2 6y ago
  You and the person I replied to above are essentially correct: >Fuzzing drivers on [FreeBSD, MacOS, and Windows] is more challenging than the Linux kernel due to the lack of support infrastructure. These OSes support neither KASAN, other sanitizers, nor coverage-based collection of executions. The lack of a memory-based sanitizer means our fuzzer only discovers bugs that trigger exceptions, and misses all bugs that silently corrupt memory. Because we cannot collect coverage information, our fuzzer cannot detect seeds that trigger new inputs. (https://nebelwelt.net/files/20SEC3.pdf https://nebelwelt.net/files/20SEC3.pdf) The researchers employed a partial workaround for the problem, but it is pretty obvious to me that the partial workaround does not level the playing field: >To alleviate the second concern, the lack of coverage-guided optimization, we experiment with cross-pollination. To seed our dumb fuzzer, we reuse the inputs generated during our Linux kernel fuzzing campaign.
  - zxombie 6y ago
    They are only partially correct about FreeBSD. In FreeBSD 12 there is no coverage sanitizer as it was added to 13 and never merged to 12. Support for KASAN, and the other sanitizers is in development, however I'm currently too busy working on other things to have time to finish it.
  - my123 6y ago
    XNU definitely supports kasan on macOS, since quite some years. (however, kasan kernels aren't shipped by default, you can build from source though) However, no idea if Kernel Debug Kit ships with prebuilt kasan kernel and drivers.
    - saagarjha 6y ago
      I see a kernel.kasan inside the latest KDK. Doubt this extends to drivers, as all I can find for those are debug symbols.

muststopmyths 6y ago

>This essentially means they found more bugs in Linux because Linux has better tools to uncover subtle memory safety bugs. Driver verifier has been part of Windows for 20+ years and detects memory overflows, underflows, use after free and whole bunch of other bad driver behavior specific to the Windows driver model. I don't see any evidence in the paper that the authors knew about it, so it's possible more bugs can be found that way in Windows using their fuzzing tools

jmeyer2k 6y ago

Instrumentation is huge too... I had a bug with the webcam on my Razer Blade which I was able to fix on Linux because it was open-source. It was a pretty simple patch and I submitted it as a patch to Linux. I had a bug with USB devices on my Mac and I had to go back and forth with Apple support for 2 weeks and ended up returning the device.