Bug Classes/Uninitialized variables

From Linux Kernel Security Subsystem
Jump to: navigation, search


When variables (on either stack or heap) are used without being explicitly initialized, behavior is "undefined". In reality, "uninitialized" just means "still has the prior value". When an attacker can control prior values, this can lead to exploitation or leaks, either through regular techniques or through "data-only" attacks.



  • clear kernel stack between system calls (e.g. PAX_MEMORY_STACKLEAK)
  • instrument compiler to fully initialize all structures (e.g. PAX_MEMORY_STRUCTLEAK)