<story><title>CVE-2022-0435: A Remote Stack Overflow in the Linux Kernel</title><url>https://www.openwall.com/lists/oss-security/2022/02/10/1</url></story><parent_chain></parent_chain><comment><author>paulmd</author><text>Quick reminder that KASLR is broken by &amp;quot;metadata leakage&amp;quot; (the metadata is the page table mappings) on AMD processors by default unless you manually enable KPTI.&lt;p&gt;This was discovered by the same team that discovered Spectre and Meltdown and the official AMD stance is WONTFIX because it can be mitigated by enabling KPTI, however they also refuse to state that KPTI should be enabled by default on their processors because that would tank their benchmarks.&lt;p&gt;They don&amp;#x27;t put it in quite those exact words in the bulletin, but the &amp;quot;user and kernel address space boundary&amp;quot; they are referring to that the exploit cannot cross is KPTI.  Turn it on and it&amp;#x27;s mitigated, if it&amp;#x27;s off kernel pages and user pages live in the same tables and are thus vulnerable.  However AMD&amp;#x27;s official stance is KPTI off-by-default, so generally they are still vulnerable unless you manually enable KPTI.&lt;p&gt;(their ass is covered by the &amp;quot;obey good security practices&amp;quot;, i.e. if you actually care you should be turning it on because it&amp;#x27;s a good security practice in general, but it would nuke their benchmarks just like it did to Intel, so they want it off by default since that&amp;#x27;s how things are usually benchmarked.)&lt;p&gt;The paper describes several approaches, some of which can be mitigated (the time and power measurement attacks) and some of which cannot except via KPTI (TLB-Evict+Prefetch).  The issue is, broadly speaking, unfixed.  And actually I think at this point it&amp;#x27;s past metadata leakage and actually just leaking data considering Lipp has extracted actual memory from the kernel.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;mlq.me&amp;#x2F;download&amp;#x2F;amdprefetch.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;mlq.me&amp;#x2F;download&amp;#x2F;amdprefetch.pdf&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.amd.com&amp;#x2F;en&amp;#x2F;corporate&amp;#x2F;product-security&amp;#x2F;bulletin&amp;#x2F;amd-sb-1017&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.amd.com&amp;#x2F;en&amp;#x2F;corporate&amp;#x2F;product-security&amp;#x2F;bulletin&amp;#x2F;a...&lt;/a&gt;</text></comment>
<story><title>CVE-2022-0435: A Remote Stack Overflow in the Linux Kernel</title><url>https://www.openwall.com/lists/oss-security/2022/02/10/1</url></story><parent_chain></parent_chain><comment><author>mindcrime</author><text>Huh. I&amp;#x27;d never heard of TIPC before now either, but this actually sounds pretty interesting now that I&amp;#x27;m reading about it. Shame that this was my first introduction to it (and from reading these threads, it seems like I&amp;#x27;m not the only one).&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Transparent_Inter-process_Communication&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Transparent_Inter-process_Comm...&lt;/a&gt;</text></comment>