This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH 0/3] explicit_bzero v5
On 11/15/2016 02:35 PM, Paul Eggert wrote:
> On 11/15/2016 10:54 AM, Zack Weinberg wrote:
>> If the adversary can read the stack at all, I suspect they've
>> already won, no matter what we do.
>
> That will likely be true in many applications, but not in all.
I doubt that very much. An adversary who can read the stack has access
to at least one pointer into the executable image (i.e. a return
address) and that is sufficient to walk the entire address space,
including all static data and the complete contents of the heap.
> It's worth documenting the issue for applications that put sensitive
> objects in the heap, as they might not expose these object addresses
> to the stack now
How on earth are they to operate on sensitive objects on the heap
without holding their addresses in function-local variables, which one
must assume do from time to time get spilled onto the stack?
zw