Re:The status of Linux kernel hardening
by viraptor on Thursday November 10, 2016 @04:54AM
(#12919072)
I didn't get that argument really. Or specifically, do we know the number of bugs which are harder to debug because now they disappear -vs- the number of bugs which were detected because kaslr breaks invalid assumptions? Maybe kaslr just exposed some ticking bombs in the code.
[ Parent
| on HN ]
I've certainly seen this for user ASLR. However it's easy to work around, you just turn off ASLR while reproducing your bug. There's a knob to tweak in /proc/sys/kernel.
Re:The status of Linux kernel hardening
by Animats on Thursday November 10, 2016 @12:41PM
(#12922470)
Doesn't help much. Turning ASLR off for a memory-clobbering bug adds repeatability, but it may be repeatable as in "never fails" if the memory clobbered isn't important. Memory is big today; most random stores won't crash the system. Now it's a "cannot reproduce" bug.
Crash reports from production systems come in, and you try to classify them. If the crashes look similar, you have something to look for. (Microsoft has a classifier to do this for Windows crashes, and that's one reason the Windows Blue Screen of Death is rare today.) Then you try to reproduce the crash situation. ASLR adds noise to that data. It's harder to match up similar bug reports.