https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295522
Bug ID: 295522
Summary: kcmp comparison results leak kernel object address
ordering (informational — no KASLR)
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Reclassified per secteam guidance — originally reported to [email protected].
The kcmp subsystem in sys/kern/sys_generic.c returns comparison results that
can
be used to reconstruct partial address ordering of kernel objects through
repeated
comparisons.
Since FreeBSD does not implement KASLR and kernel addresses are already
accessible
through multiple existing channels (/dev/kmem, sysctl, kldstat, etc.), this has
no
current security impact. Filed as an informational note.
If FreeBSD implements KASLR in the future, this interface should be reviewed to
prevent address ordering leakage.
--
You are receiving this mail because:
You are the assignee for the bug.
