Subject: Re: [Security] [SECURITY] Fix leaking of kernel heap addresses via /proc

From: Ted Ts'o <[email-masked]>
Date: Sat, 6 Nov 2010 19:48:40 -0400

On Sat, Nov 06, 2010 at 01:50:32PM -0700, Linus Torvalds wrote:
> On Saturday, November 6, 2010, Dan Rosenberg <[email-masked]> wrote:
> > Clearly, in most cases we cannot just remove the field from the /proc
> > output, as this would break a number of userspace programs that rely on
> > consistency.  However, I propose that we replace the address with a "0"
> > rather than leaking this information.
> 
> I really think it would be much better to use the unidentified number
> or similar.
> 
> Just replacing with zeroes is annoying, and has the potential of
> losing actual information.

Are there any userspace programs that might be reasonably expected to
_use_ this information?  If there is, we could just pick a random
number at boot time, and then XOR the heap adddress with that random
number.

						- Ted