Bug Classes/Uninitialized variables

From Linux Kernel Security Subsystem
Revision as of 22:44, 4 November 2015 by KeesCook (talk | contribs) (Created page with "= Details = When variables (on either stack or heap) are used without being explicitly initialized, behavior is "undefined". In reality, "uninitialized" just means "still has ...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Details

When variables (on either stack or heap) are used without being explicitly initialized, behavior is "undefined". In reality, "uninitialized" just means "still has the prior value". When an attacker can control prior values, this can lead to exploitation or leaks, either through regular techniques or through "data-only" attacks.

Examples

Mitigations

  • clear kernel stack between system calls (e.g. PAX_MEMORY_STACKLEAK)
  • instrument compiler to fully initialize all structures (e.g. PAX_MEMORY_STRUCTLEAK)