Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by sst8 on Thursday March 02, 2017 @12:53PM
(#13776349)
Well, with micropatching you don't need to reboot and you only have to review minimum code changes - and if the patch is not working for you you can unpatch it (with proper permissions, ofcourse).
Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by j_s on Thursday March 02, 2017 @01:27PM
(#13776732)
Pretty sure this specific example would require a reboot, changing a Windows kernel DLL. There seems to be some confusion over whether or not the 0patch tool can update the kernel without a reboot, though. https://news.ycombinator.com/item?id=13775550
Patching a user mode app/dll would not require a reboot, just a restart of the app.
Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by dielel on Friday March 03, 2017 @08:58AM
(#13782830)
Hi,
Stanka from 0patch here. If you want to enable or disable (aka "patch" or "unpatch" the application) you don't need do restart the application. Not even if your app is running and you've just install 0patch agent. This is how it is designed to work in user space. When the official MS patch is installed (hopefully with the fix) this particular 0patch won't apply anymore.
As we try to make 0patch agent robust and reliable we don't support kernel mode at this moment - we will make this step slow and with great caution.
Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by j_s on Friday March 03, 2017 @09:32AM
(#13783051)
Can you please clarify whether or not this specific patch is user mode or kernel mode? @johntb86 mentioned GDI is split and this is the user mode part.
Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by dielel on Friday March 03, 2017 @09:45AM
(#13783152)
Our micropatch (7 of them, really, for 4 different Windows OS versions) for CVE-2017-0038 is user-mode. As are currently all our micropatches. Processes using gdi32.dll do not need to be relaunched to have it applied.
Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by johntb86 on Thursday March 02, 2017 @08:34PM
(#13780068)
I believe this code is in gdi32.dll and is one of the few pieces of GDI implemented in user mode. However you'd probably still need to reboot because almost every program in windows is linked with it and would need to be restarted.
Re:0patching a 0-day: Windows gdi32.dll memory disclosure
by hermitdev on Thursday March 02, 2017 @08:44PM
(#13780112)
Another reason, with small patches, especially those that actually do a binary patch instead of replacing affected files, you must apply every single patch that affects that file, and you must apply them in the correct order.
Back in the day when binary patching was the norm, this was a common pain point. Good patches at least did a minimal checksum check to make sure they had the correct starting point. Bad ones made no backups and just went to town, and failures meant reinstalling and trying all over again.
This was how things worked previously in the industry. There are a number of disadvantages to companies releasing multiple small patches throughout the month:
1. Users may have to reboot their computers multiple times a week.
2. Large corporations (with their own back-compat worries) do their own extensive validation of patches. Multiple small patches puts a large seriously burden on IT departments.
The industry has moved towards larger update bundles for good reason.