Bug Classes/Uninitialized variables

From Linux Kernel Security Subsystem
Jump to navigation Jump to search

Details

When variables (on either stack or heap) are used without being explicitly initialized, behavior is "undefined". In reality, "uninitialized" just means "still has the prior value". When an attacker can control prior values, this can lead to exploitation or leaks, either through regular techniques or through "data-only" attacks.

Examples

Mitigations

  • clear kernel stack between system calls (e.g. PAX_MEMORY_STACKLEAK)
  • instrument compiler to fully initialize all structures (e.g. PAX_MEMORY_STRUCTLEAK)