Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
On Mon, Mar 11, 2013 at 12:42 PM, Eric W. Biederman wrote: > Kees Cook writes: > >> On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: >>> On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Eric W. Biederman
Kees Cook writes: > On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: >> On 03/11, Kees Cook wrote: >>> >>> When the new signal handlers are set up for a fork, the location of >>> sa_restorer is not cleared, leaking a parent process's address space >>> location to children. This allows for

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Oleg Nesterov
On 03/11, Kees Cook wrote: > On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: > > On 03/11, Kees Cook wrote: > >> > >> When the new signal handlers are set up for a fork, the location of > >> sa_restorer is not cleared, leaking a parent process's address space > >> location to children.

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: > On 03/11, Kees Cook wrote: >> >> When the new signal handlers are set up for a fork, the location of >> sa_restorer is not cleared, leaking a parent process's address space >> location to children. This allows for a potential bypass of the

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Oleg Nesterov
On 03/11, Kees Cook wrote: > > When the new signal handlers are set up for a fork, the location of > sa_restorer is not cleared, leaking a parent process's address space > location to children. This allows for a potential bypass of the parent's > ASLR by examining the sa_restorer value returned

[PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a parent process's address space location to children. This allows for a potential bypass of the parent's ASLR by examining the sa_restorer value returned when calling sigaction(). $ cat

[PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a parent process's address space location to children. This allows for a potential bypass of the parent's ASLR by examining the sa_restorer value returned when calling sigaction(). $ cat

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Oleg Nesterov
On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a parent process's address space location to children. This allows for a potential bypass of the parent's ASLR by examining the sa_restorer value returned when

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov o...@redhat.com wrote: On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a parent process's address space location to children. This allows for a potential bypass

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Oleg Nesterov
On 03/11, Kees Cook wrote: On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov o...@redhat.com wrote: On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a parent process's address space location to children.

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Eric W. Biederman
Kees Cook keesc...@chromium.org writes: On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov o...@redhat.com wrote: On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a parent process's address space location to

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
On Mon, Mar 11, 2013 at 12:42 PM, Eric W. Biederman ebied...@xmission.com wrote: Kees Cook keesc...@chromium.org writes: On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov o...@redhat.com wrote: On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of