ncurses in 7.5

2024-04-09 Thread fro
Hello,   https://www.openbsd.org/plus75.html says: Updated ncurses and associated libraries (form, panel, menu) to 6.4-20230826.   but https://www.openbsd.org/75.html says:  Ncurses 5.7    Is this an oversight or am I overlooking something?    

Re: ROP Exploitation in openbsd-64 Programs After Removing ROP Gadgets

2023-10-09 Thread fro
Can you show how you arrived at these results? The more detailed the better. Perhaps this should be its own blog post somewhere as well. I can't speak to the suggested experiments other than to say that having a wider audience may be of help.       Sent: Saturday, October 07, 2023 at 8:13 PM

Re: ROP Exploitation in openbsd-64 Programs After Removing ROP Gadgets

2023-09-21 Thread fro
Why are you targeting 6.4? That was released in 2018. So, that's 5 years and 9 releases since then and another one is happening soon.       Sent: Thursday, September 21, 2023 at 8:50 AM From: "Nan ZoE" To: misc@openbsd.org Subject: ROP Exploitation in openbsd-64 Programs After Removing ROP Gadge

Re: Sanitizers/Fuzzing Support

2022-12-06 Thread fro
Yes, I've seen that. This does not answer my question. See https://man.openbsd.org/kubsan which is not listed there at all.   Sent: Tuesday, December 06, 2022 at 7:16 AM From: "Bodie" To: misc@openbsd.org Subject: Re: Sanitizers/Fuzzing Support On Tue Dec 6, 2022 at 5:27 AM CET, wrote: > Hello,

Sanitizers/Fuzzing Support

2022-12-05 Thread fro
Hello, I see that OpenBSD supports KUBSAN. Does OpenBSD have support for KASAN, KMSAN, KLEAK, etc? (or similar things)  

Re: VMM vulns?

2020-09-10 Thread fro
So, if I'm reading this all correctly it looks like _most_ of the issues have been addressed. Seems these are left:   - The TLB handling of guest pages is broken, in that the INVEPT     instructions in the host could be issued on the wrong CPUs. This means     that if UVM decides to swap out a gu

VMM vulns?

2020-09-01 Thread fro
https://twitter.com/m00nbsd/status/1291257985734410244 I don't want to bump that old thread or start any arguments about this. I'm just curious if this tweet is accurate or have these issues been addressed? Were any of Maxime's suggestions implemented?