3 ms·

It is true that the ext4 filesystem driver is a large attack surface The problem is that reasoning can be applied to any feature you want to get rid of. A good

It is true that the ext4 filesystem driver is a large attack surface The problem is that reasoning can be applied to any feature you want to get rid of. A good reason would be, we had N vulnerabilities in ext4 in the last six months, which is more than the kernel FAT support, which had only M vulnerabilities. Besides that, the attack vector seems fairly theoretical to me. Most users will take a blank SD card and format it as ext4 themselves.

kentonv 12y ago
> The problem is that reasoning can be applied to any feature you want to get rid of. Well, of course it can. That's more or less the Chrome team's point: they want to remove any feature that isn't widely used, because every feature is an attack vector. > A good reason would be, we had N vulnerabilities in ext4 in the last six months, which is more than the kernel FAT support, which had only M vulnerabilities. Not really, no. The absence of reported vulnerabilities in a time period could mean that there are none, but more likely it just means no one has looked, like with Bash. The things you need to ask yourself when considering attack surface reduction are: * How complicated is this piece of code? (More complication = more bugs.) * Is it likely that this code has been well-studied with respect to the proposed threat model? (For ext4, probably not -- it's designed to be used on your internal disk, which is not an attack vector.) * How painful would it be for users to simply remove it? (Obviously, removing ext4 harms far fewer users than removing FAT, developers notwithstanding.) > Besides that, the attack vector seems fairly theoretical to me. Most users will take a blank SD card and format it as ext4 themselves. Theoretical? Flash drives loaded with malware are an actual, widely-used attack vector, used by everyone from simple identity thieves to governments (look up Stuxnet, which was used to damage Iran's nuclear infrastructure). Things have gotten better since Windows stopped auto-running software on such drives, but a filesystem exploit that kicks in on mount would be more effective and harder to detect (no telltale files visible in the file browser).
- kentonv 12y ago
  OK, I actually asked a kernel dev friend about this because it affects my work on sandstorm.io, and he says that defense against malicious filesystems is in fact something Theodore Ts'o, the ext4 maintainer (and Googler), cares deeply about. Awesome! Now, that doesn't automatically mean it's safe, but given this new piece of information, I'd say that the case for removing ext4 for attack surface reasons is significantly weakened.

kentonv 12y ago

> The problem is that reasoning can be applied to any feature you want to get rid of. Well, of course it can. That's more or less the Chrome team's point: they want to remove any feature that isn't widely used, because every feature is an attack vector. > A good reason would be, we had N vulnerabilities in ext4 in the last six months, which is more than the kernel FAT support, which had only M vulnerabilities. Not really, no. The absence of reported vulnerabilities in a time period could mean that there are none, but more likely it just means no one has looked, like with Bash. The things you need to ask yourself when considering attack surface reduction are: * How complicated is this piece of code? (More complication = more bugs.) * Is it likely that this code has been well-studied with respect to the proposed threat model? (For ext4, probably not -- it's designed to be used on your internal disk, which is not an attack vector.) * How painful would it be for users to simply remove it? (Obviously, removing ext4 harms far fewer users than removing FAT, developers notwithstanding.) > Besides that, the attack vector seems fairly theoretical to me. Most users will take a blank SD card and format it as ext4 themselves. Theoretical? Flash drives loaded with malware are an actual, widely-used attack vector, used by everyone from simple identity thieves to governments (look up Stuxnet, which was used to damage Iran's nuclear infrastructure). Things have gotten better since Windows stopped auto-running software on such drives, but a filesystem exploit that kicks in on mount would be more effective and harder to detect (no telltale files visible in the file browser).

kentonv 12y ago
OK, I actually asked a kernel dev friend about this because it affects my work on sandstorm.io, and he says that defense against malicious filesystems is in fact something Theodore Ts'o, the ext4 maintainer (and Googler), cares deeply about. Awesome! Now, that doesn't automatically mean it's safe, but given this new piece of information, I'd say that the case for removing ext4 for attack surface reasons is significantly weakened.