Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

[Alan Coopersmith]

As we expand our use of shared memory via the new extensions, we should try
to make sure we're not making more problems along the lines of those mentioned
in the presentation linked below & associated whitepaper published at:
http://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/

(It does seem most of the issues are in the clients creating shmem insecurely
  before passing it to the X libraries, but I've not had time to do much analysis
  beyond a quick readthrough of the slides & paper.)

	-alan-


-------- Original Message --------
Subject: [oss-security] "I miss LSD", slides, paper and tools relating to 
finding UNIX system level vulnerabilities (as given at 44CON)
Date: Thu, 14 Nov 2013 12:20:23 +0000
From: Tim Brown <tmb at 65535.com>
Reply-To: oss-security at lists.openwall.com
To: oss-security at lists.openwall.com

All,

Some of you may already have spotted this, but last night we published our
slides, paper and some tools from my talk at 44CON earlier in the year.  The
content can be found at:

* http://labs.portcullis.co.uk/presentations/i-miss-lsd/

The take home points around the System V shared memory issues (detailed in
more detail in the linked to paper) are:

* System V shared memory is often created with weak permissions.
* Usage of System V shared memory by X11 applications is particularly
problematic.
* Qt Project patched Qt APIs (CVE-2013-0254), Oracle patched Java JRE
(CVE-2013-1500), Google patched Chrome independently.
* No progress has been made on the problem more generally by either Red Hat or
Debian.
* Coccinelle is an effective tool for performing static analysis on large
corpuses of C.
* Memory corruption attacks against System V shared memory are unlikely.

I've also released a tool called smaSHeM (again linked to) for dumping System
V shared memory and for manipulating it.

Tim
-- 
Tim Brown
<mailto:tmb at 65535.com>



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20131114/5d325ad0/attachment.pgp>