lkml.org 
[lkml]   [2013]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH 1/9] Known exploit detection
    From
    On Fri, Dec 13, 2013 at 10:14 AM, Linus Torvalds
    <torvalds@linux-foundation.org> wrote:
    > On Fri, Dec 13, 2013 at 9:58 AM, Kees Cook <keescook@chromium.org> wrote:
    >>
    >> These locations tend to be very hard to reach accidentally
    >
    > Not necessarily.
    >
    > Don't get me wrong - I think that it's a good idea to at least have
    > the option to complain about certain errors, and leave markers in the
    > logs about things that look suspicious.
    >
    > But looking through the recent list of commits that explicitly mention
    > a CVE, the only one I find where a syslog message would make sense is
    > the HID validation ones. There, adding a warning about malicious HID
    > devices sounds like a good idea.
    >
    > But a *lot* of the rest is just checking ranges or making sure we have
    > proper string handling etc that just wouldn't be practical to check.
    > So the error itself may be "hard to reach accidentally", but
    > *checking* it would be so complex/painful that it would likely just
    > introduce more room for bugs.
    >
    > So I think the "WARNING" thing is a good idea, but I think it is a
    > good idea if it's used very judiciously. IOW, not for "random CVE"
    > (because quite frankly, most of them seem to be utter shit), but for
    > serious known issues. And for those issues *only*.
    >
    > If I start seeing patches adding warnings "just because there's a
    > CVE", then I'm not in the least interested. But if there is some known
    > root-kit or similar, then by all means..

    Yeah, totally agreed. Doing it for all CVEs (or even most) would be a
    disaster. Stuff like memory content leak CVEs are usually on common
    paths that userspace uses all the time. Vegard proposed only doing it
    for serious privilege escalation issues, and I couldn't agree more.

    -Kees

    --
    Kees Cook
    Chrome OS Security


    \
     
     \ /
      Last update: 2013-12-13 20:21    [W:3.641 / U:1.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site