Re: Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-15 Thread Mouse
>>> My understanding is that the new code, by passing shared memory >>> through fd is a lot better since [...] >> In those respects, yes. But it's worse in that it requires write >> access to a filesystem - a filesystem which supports mmap - with >> space enough to hold the shared memory segments,

Re: Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-15 Thread Dr. David Alan Gilbert
* Alan Coopersmith (alan.coopersm...@oracle.com) wrote: > As we expand our use of shared memory via the new extensions, we should try > to make sure we're not making more problems along the lines of those mentioned > in the presentation linked below & associated whitepaper published at: > http://la

Re: Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-15 Thread Mark Kettenis
> Date: Fri, 15 Nov 2013 02:16:19 -0500 (EST) > From: Mouse > > > My understanding is that the new code, by passing shared memory > > through fd is a lot better since [...] > > In those respects, yes. But it's worse in that it requires write > access to a filesystem - a filesystem which support

Re: Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-14 Thread Matthieu Herrb
On Fri, Nov 15, 2013 at 02:16:19AM -0500, Mouse wrote: > > My understanding is that the new code, by passing shared memory > > through fd is a lot better since [...] > > In those respects, yes. But it's worse in that it requires write > access to a filesystem - a filesystem which supports mmap -

Re: Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-14 Thread Mouse
> My understanding is that the new code, by passing shared memory > through fd is a lot better since [...] In those respects, yes. But it's worse in that it requires write access to a filesystem - a filesystem which supports mmap - with space enough to hold the shared memory segments, which MIT-S

Re: Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-14 Thread Matthieu Herrb
On Thu, Nov 14, 2013 at 06:18:06PM -0800, Alan Coopersmith wrote: > As we expand our use of shared memory via the new extensions, we should try > to make sure we're not making more problems along the lines of those mentioned > in the presentation linked below & associated whitepaper published at: >

Fwd: [oss-security] "I miss LSD", slides, paper and tools relating to finding UNIX system level vulnerabilities (as given at 44CON)

2013-11-14 Thread Alan Coopersmith
As we expand our use of shared memory via the new extensions, we should try to make sure we're not making more problems along the lines of those mentioned in the presentation linked below & associated whitepaper published at: http://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-sys