stackprotector: ascii armor the stack canary
Status from this message: [merged] sh64-ascii-armor-the-sh64-boot-init-stack-canary.patch removed from -mm tree
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest5 patches 10 repliesApplied 5/6
- v15 patches 1 replySuperseded
Changes in v2 from the cover letter
- improve changelogs
- address Ingo's coding style comments
Patches in v2 Applied · 5/6
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | random,stackprotect: introduce get_random_canary functioninclude/ | +21 | 1 reply | Applied |
| 2/5 | fork,random: use get_random_canary to set tsk->stack_canarykernel/ | +1 | 1 reply | Applied |
| 3/5 | x86: ascii armor the x86_64 boot init stack canaryarch/ | +1 | 1 reply | Applied |
| 4/5 | arm64: ascii armor the arm64 boot init stack canaryarch/ | +1 | 1 reply | Applied |
| 5/5 | sh64: ascii armor the sh64 boot init stack canaryarch/ | +1 | 0 replies | |
| 5/5 | sh64: ascii armor the sh64 boot init stack canaryarch/ | +1 | 1 reply | Applied |
Reviews trailers per patch
All 6 patches have a Reviewed-by or Acked-by.
| Patch | Kees Cook |
|---|---|
| 1/5 | A-b |
| 2/5 | A-b |
| 3/5 | A-b |
| 4/5 | A-b |
| 5/5 | A-b |
| 5/5 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v2 0/5] stackprotector: ascii armor the stack canary
Zero out the first byte of the stack canary value on 64 bit systems, in order to mitigate unterminated C string overflows.
The null byte both prevents C string functions from reading the canary, and from writing it if the canary value were guessed or obtained through some other means.
Reducing the entropy by 8 bits is acceptable on 64-bit systems, which will still have 56 bits of entropy left, but not on 32 bit systems, so the "ascii armor" canary is only implemented on 64-bit systems.
Inspired by the "ascii armor" code in execshield and Daniel Micay's linux-hardened tree.
Also see https://github.com/thestinger/linux-hardened/
v2:
- improve changelogs
- address Ingo's coding style comments