lkml.org 
[lkml]   [2002]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: remote memory reading using arp?
On 28 Apr 2002, Andi Kleen wrote:

> Bryan Rittmeyer <bryan@ixiacom.com> writes:
>
> > It's not the ARP layer that's causing the padding... Ethernet has a
> > minimum transmit size of 64 bytes (everything below that is disgarded
> > by hardware as a fragment), so the network device driver or
> > the hardware itself will pad any Linux skb smaller than 60 bytes up to
> > that size (so that it's 64 bytes after appending CRC32). Apparently, in
> > some cases that's done by just transmitting whatever uninitialized
> > memory follows skb->data, which, after the system has been running
> > for a while, may be inside a page previously used by userspace.
>
> The driver should be fixed in that case. I would consider it a driver
> bug. The cost of clearing the tail should be minimal, it is at most

Yes, I wholeheartedly agree. Also, the notion that it's userspace's
responsibility to clear memory before exiting is preposterous. That would
involve just about every piece of software ever made to be rewritten (you
could change glibc to clear memory on free()s but what about the stack?).


> two cache lines.
>
> Is it known which driver caused this?
>
> >
> > This is NOT a "remote memory reading" exploit, since there is no way to
>
> It really is.

Yes. If you snoop long enough, it becomes possible to read passords and
other sensitive data. Granted, this is only on the local network, but
it is still a major hole.

>
>
> -Andi
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:25    [W:0.073 / U:0.880 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site