Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
On Mon, Mar 11, 2013 at 12:42 PM, Eric W. Biederman wrote: > Kees Cook writes: > >> On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: >>> On 03/11, Kees Cook wrote: When the new signal handlers are set up for a fork, the location of sa_restorer is not cleared, leaking a paren

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Eric W. Biederman
Kees Cook writes: > On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: >> On 03/11, Kees Cook wrote: >>> >>> When the new signal handlers are set up for a fork, the location of >>> sa_restorer is not cleared, leaking a parent process's address space >>> location to children. This allows for

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Oleg Nesterov
On 03/11, Kees Cook wrote: > On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: > > On 03/11, Kees Cook wrote: > >> > >> When the new signal handlers are set up for a fork, the location of > >> sa_restorer is not cleared, leaking a parent process's address space > >> location to children. This

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Kees Cook
On Mon, Mar 11, 2013 at 12:28 PM, Oleg Nesterov wrote: > On 03/11, Kees Cook wrote: >> >> When the new signal handlers are set up for a fork, the location of >> sa_restorer is not cleared, leaking a parent process's address space >> location to children. This allows for a potential bypass of the p

Re: [PATCH] signal: always clear sa_restorer on execve

2013-03-11 Thread Oleg Nesterov
On 03/11, Kees Cook wrote: > > When the new signal handlers are set up for a fork, the location of > sa_restorer is not cleared, leaking a parent process's address space > location to children. This allows for a potential bypass of the parent's > ASLR by examining the sa_restorer value returned whe