Am 08.05.2016 um 17:40 schrieb Kangjie Lu: > > > On Sun, May 8, 2016 at 8:58 AM, Richard Weinberger > <richard.weinber...@gmail.com <mailto:richard.weinber...@gmail.com>> wrote: > > On Tue, May 3, 2016 at 10:34 PM, Kangjie Lu <kangji...@gmail.com > <mailto:kangji...@gmail.com>> wrote: > > The stack object “si” has a total size of 128 bytes; however, only > > 16 bytes are initialized. The remaining uninitialized bytes are > > sent to userland via send_signal. > > How did you find all these leaks? > Since you sent more than one patch I guess you used some tool, which one? > > > Yes. Since there are *so many* infoleak vulnerabilities in the kernel, we are > writing a > static checker to find them. We plan to release it once it is done, so > people can use > it to find more bugs in kernel or even other user space programs.
How does your tool work? I'd guess it tries to find uninitialized structs passed into copy_to_user(). Thanks, //richard
