Copy Fail 2: Electric Boogaloo
github.com
Copy Fail 2: Electric Boogaloo
1–10 of 14 posts
Re: Copy Fail 2: Electric Boogaloo
#2How much pain must there be until people realize we actually do need memory safety?
Re: Copy Fail 2: Electric Boogaloo
#3How much pain must there be until people realize we actually do need memory safety?
How would've memory safety helped here?
Re: Copy Fail 2: Electric Boogaloo
#4How much pain must there be until people realize we actually do need memory safety?
How would've memory safety helped here?
In CHERI, for example, pointers have permissions. The pointer to the COW memory would not have the "write" permission.
I could be misunderstanding the bug, of course.
Re: Copy Fail 2: Electric Boogaloo
#5sysctl kernel.unprivileged_userns_clone=1 keeps on giving.
Re: Copy Fail 2: Electric Boogaloo
#6Earlier quoted context omitted.
How would've memory safety helped here?
In CHERI, for example, pointers have permissions. The pointer to the COW memory would not have the "write" permission. I could be misunderstanding the bug, of course.
If you "forget" to mark COW memory pointer as no-write, the net effect would be same, would it not? If I'm reading the diff correctly, the problem was that code missed to mark some pages as shared (aka no-write).
Re: Copy Fail 2: Electric Boogaloo
#7Earlier quoted context omitted.
In CHERI, for example, pointers have permissions. The pointer to the COW memory would not have the "write" permission. I could be misunderstanding the bug, of course.
If you "forget" to mark COW memory pointer as no-write, the net effect would be same, would it not? If I'm reading the diff correctly, the problem was that code missed to mark some pages as shared (aka no-write).
A fair point...
I thought the bug was a missing check for the COW flag, but looking at it again it seems it was missing both setting and checking the flag.
Re: Copy Fail 2: Electric Boogaloo
#8sysctl kernel.unprivileged_userns_clone=1 keeps on giving.
Yes. Giving me a massive... Well.. Dopamine rush.
Re: Copy Fail 2: Electric Boogaloo
#9Earlier quoted context omitted.
If you "forget" to mark COW memory pointer as no-write, the net effect would be same, would it not? If I'm reading the diff correctly, the problem was that code missed to mark some pages as shared (aka no-write).
A fair point... I thought the bug was a missing check for the COW flag, but looking at it again it seems it was missing both setting and checking the flag.
Apparently it is both...
Re: Copy Fail 2: Electric Boogaloo
#10How is this different from Dirty Frag [0]?
It seems to use the same vector.