Moderator/ica: Moderatori/ce
systemd can't handle the process previlege that belongs to user name startswith number, such as 0day
Jaya Baloo (KPN) - How we do CISO @ KPN
Ivan Fratrić (Google Project Zero)
Xavier Mertens - HTTP for the Good or the Bad
Arnim Eijkhoudt (KPN)
x0rz
Brent Cook (Rapid7)
live0verflow
shrike je napisao/la:Bochspwn Reloaded
Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking
Zanimljiv PDF tekst o kernel leakovima i njihovoj detekciji (nije previše dug): http://j00ru.vexillium.org/slides/2017/recon.pdf
Summary of the results so far
•A total of 29 vulnerabilities fixed by Microsoft in the last months (mostly June).
Windows infoleak summary
•The problem seems to have remained almost completely unrecognized until just now (with a few exceptions).
•Windows has a very loose approach to kernel→user data transfers.
•Tip of the iceberg, there may be many more instances of the bug lurking in the codebase.
•Hundreds of memcpy() calls to user-mode exist, every one of them is a potential disclosure.
•Especially those where size is user-controlled, but the amount of relevant data is fixed or otherwise limited.
•Lack of source code makes it very difficult to determine if an access is a bug and what its impact is.
Direct kernel→user disclosures
•Just one (1) minor bug!
•Disclosure of 7 uninitialized kernel stack bytes in the handling of specific IOCTLs in ctl_ioctl(drivers/md/dm-ioctl.c).
•/dev/control/mapper device, only accessible to root.
•Looks like Linux doesn’t have any direct, trivially reachable infoleaks to user-mode...
Conclusions
•The Linux community has been on top of the problem for the last few
years.
•Seemingly hardly any easy infoleaks left at all at this point.
•Some uses of uninit memory, but even these are not trivial to find.
•Even when bugs show up, they are rather short-lived.
•Most remaining bugs should be swept off by KMSAN in the near future.
