[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Unfixed FreeBSD uninitialized memory disclosures
From:       Vlad Tsyrklevich <vlad () tsyrklevich ! net>
Date:       2019-01-20 23:53:18
Message-ID: CAH0z3hNq8mSGrMcE2Zr_o5OOEcdA7gkZ4iZTC6d7+kav+70jYA () mail ! gmail ! com
[Download RAW message or body]


In January 2017 I reported results of a clang analyzer-based static
analysis step [1] to find uninitialized kernel-to-userland memory
disclosures against a number of kernels. I reported results in the FreeBSD
kernel to their security team. Over the next 2 years some [2][3][4] of the
bugs were fixed but it seems like only when they were re-reported.

I re-ran the analyzer against an updated FreeBSD kernel and reported
updated results [5] last month--the crossed out reports are false positives
as determined by manual inspection. Though the impact of these bugs is not
critical, they are worth fixing. I've contacted the security team again but
it did not sound like these reports were prioritized to be fixed
immediately. I'm e-mailing oss-security to let other downstream FreeBSD
users patch them on their own if they were so inclined. Most of them can be
fixed by simply adding a memset() or an M_ZERO to malloc().

[1] https://tsyrklevich.net/2017/03/27/kernel-clang-analyzer/
[2] https://www.freebsd.org/security/advisories/FreeBSD-SA-17:10.kldstat.asc
[3] https://www.freebsd.org/security/advisories/FreeBSD-EN-18:05.mem.asc
[4] https://www.freebsd.org/security/advisories/FreeBSD-EN-18:12.mem.asc
[5] https://tsyrklevich.net/clang_analyzer/freebsd_122818/


[prev in list] [next in list] [prev in thread] [next in thread]