[lkml]   [2013]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 1/9] Known exploit detection
On Fri, Dec 13, 2013 at 9:58 AM, Kees Cook <> wrote:
> These locations tend to be very hard to reach accidentally

Not necessarily.

Don't get me wrong - I think that it's a good idea to at least have
the option to complain about certain errors, and leave markers in the
logs about things that look suspicious.

But looking through the recent list of commits that explicitly mention
a CVE, the only one I find where a syslog message would make sense is
the HID validation ones. There, adding a warning about malicious HID
devices sounds like a good idea.

But a *lot* of the rest is just checking ranges or making sure we have
proper string handling etc that just wouldn't be practical to check.
So the error itself may be "hard to reach accidentally", but
*checking* it would be so complex/painful that it would likely just
introduce more room for bugs.

So I think the "WARNING" thing is a good idea, but I think it is a
good idea if it's used very judiciously. IOW, not for "random CVE"
(because quite frankly, most of them seem to be utter shit), but for
serious known issues. And for those issues *only*.

If I start seeing patches adding warnings "just because there's a
CVE", then I'm not in the least interested. But if there is some known
root-kit or similar, then by all means..


 \ /
  Last update: 2013-12-13 20:01    [W:0.094 / U:1.996 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site