From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 6CFA5C0B for ; Mon, 24 Aug 2015 23:13:41 +0000 (UTC) Received: from mail-ob0-f171.google.com (mail-ob0-f171.google.com [209.85.214.171]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 01C8A19F for ; Mon, 24 Aug 2015 23:13:39 +0000 (UTC) Received: by obbfr1 with SMTP id fr1so127275822obb.1 for ; Mon, 24 Aug 2015 16:13:39 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <1440446941.2201.32.camel@HansenPartnership.com> From: Andy Lutomirski Date: Mon, 24 Aug 2015 16:13:19 -0700 Message-ID: To: Kees Cook Content-Type: text/plain; charset=UTF-8 Cc: James Bottomley , "ksummit-discuss@lists.linuxfoundation.org" , Emily Ratliff Subject: Re: [Ksummit-discuss] [TECH TOPIC] Kernel Hardening List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Mon, Aug 24, 2015 at 3:55 PM, Kees Cook wrote: > On Mon, Aug 24, 2015 at 1:09 PM, James Bottomley > wrote: >> On Mon, 2015-08-24 at 09:35 -0700, Kees Cook wrote: >>> The >>> hardening the kernel needs is about taking away exploitation tools, >>> not killing bugs. (Though killing bugs is still great.) >> >> It's both. One of the old standards for attacking C code was buffer >> overruns. Remove those via detection tools and you reduce the attack >> surface. > > Well, attack surface is just what interfaces are exposed to an > attacker. But yes, killing bug classes is important. Making bugs > unexploitable is even better because then security bugs really do just > become bugs. There are plenty of cases where mitigation of an exploit technique class changes a family of bugs from privilege escalation to DoS, and that's a big deal. For example, min mmap addresses mostly turn NULL-pointer dereferences into DoS. SMAP (and, to a lesser extent, UDEREF) turns "upside-down" gsbase (a lovely x86ism that's involved in the BadIRET privesc and quite a few others) into just DoS. These aren't cases where it's a PITA for an attacker to get more than DoS -- these are cases where the mitigations really do prevent privilege escalation completely because they kick in before the attacker gets to control a value that's used for anything. --Andy