Text relocations in kernel modules

[Peter Wemm]

On Mon, Apr 2, 2012 at 10:31 AM, Richard Yao <ryao at cs.stonybrook.edu> wrote:
> On 04/02/12 13:13, Tom Evans wrote:
>> On Mon, Apr 2, 2012 at 5:49 PM, Richard Yao <ryao at cs.stonybrook.edu> wrote:
>>> On 04/02/12 05:56, Tom Evans wrote:
>>>> On Sat, Mar 31, 2012 at 3:42 AM, Richard Yao <ryao at cs.stonybrook.edu> wrote:
>>>>>> There are no security implications, no system resources to be wasted.
>>>>>>
>>>>>> And if you think there are security implications, then lets see a
>>>>>> proof-of-concept.
>>>>>
>>>>> If I find time to write a proof-of-concept, I promise to publish it
>>>>> publicly. Your security team will find out when everyone else does.
>>>>
>>>> Richard, I'm not sure what you are trying to accomplish here. You have
>>>> had a clear explanation of why certain things are done in a certain
>>>> way in the FreeBSD codebase, and a confirmation that they do not think
>>>> it causes any security issues in FreeBSD.
>>>>
>>>> Your response is to threaten to write an exploit against FreeBSD, and
>>>> distribute it publicly before disclosing to security at .
>>>
>>> Some people believe that projects that do not take proper
>>> countermeasures against security vulnerabilities do not deserve to have
>>> special notification of issues. I happen to be one of them.
>>
>> This is a straw man argument - FreeBSD does take proper
>> countermeasures against security vulnerabilities - and so your
>> conclusion that you can blithely fully disclose vulnerabilities with
>> no moral concerns is a logical fallacy.
>
> My opinion is that any OS that lacks ALSR lacks proper countermeasures
> against vunerabilities that ASLR would kill. Furthermore, I believe that
> trying to minimize the impact of bugs that would be addressed by ASLR is
> ultimately harmful to users' security. Logically, full disclosure would
> only apply to attacks that ASLR would kill.

Remember.. ASLR is a userland thing.  .ko files, which is what this
thread is about, already use random address layout.  When you do a
"kldload virtio.ko", you have no way to predict what address it will
be loaded at.  And you don't even have access to the addresses.

Of course if you want to talk about ASLR and userland .so files then
that's an entirely different thing.  But this thread is about your
tools finding DT_TEXTREL in a .ko kernel file, not userland .so files.

-- 
Peter Wemm - peter at wemm.org; peter at FreeBSD.org; peter at yahoo-inc.com; KI6FJV
"All of this is for nothing if we don't go to the stars" - JMS/B5
"If Java had true garbage collection, most programs would delete
themselves upon execution." -- Robert Sewell