From owner-freebsd-security@FreeBSD.ORG Mon Apr 21 15:23:31 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8C813F7D for ; Mon, 21 Apr 2014 15:23:31 +0000 (UTC) Received: from st11p09mm-asmtp001.mac.com (st11p09mm-asmtp001.mac.com [17.164.24.96]) by mx1.freebsd.org (Postfix) with ESMTP id 5173312D6 for ; Mon, 21 Apr 2014 15:23:30 +0000 (UTC) MIME-version: 1.0 Received: from [10.71.14.16] (dsl-hkibrasgw1-58c380-33.dhcp.inet.fi [88.195.128.33]) by st11p09mm-asmtp001.mac.com (Oracle Communications Messaging Server 7u4-27.08(7.0.4.27.7) 64bit (built Aug 22 2013)) with ESMTPSA id <0N4E003R902N4O70@st11p09mm-asmtp001.mac.com> for freebsd-security@freebsd.org; Mon, 21 Apr 2014 15:23:16 +0000 (GMT) Content-type: multipart/signed; boundary="Apple-Mail=_5ACB6A6C-91B4-4C5D-A5BA-DAE79AA198E4"; protocol="application/pgp-signature"; micalg=pgp-sha512 Subject: Re: De Raadt + FBSD + OpenSSH + hole? From: Kimmo Paasiala In-reply-to: <201404210306.s3L36JfU020865@catnip.dyslexicfish.net> Date: Mon, 21 Apr 2014 18:23:07 +0300 Message-id: <89978872-0943-417C-9A96-9DB24E5D6CB8@icloud.com> References: <534B11F0.9040400@paladin.bulgarpress.com> <201404141207.s3EC7IvT085450@chronos.org.uk> <201404141232.s3ECWFQ1081178@catnip.dyslexicfish.net> <53522186.9030207@FreeBSD.org> <201404200548.s3K5mV7N055244@catnip.dyslexicfish.net> <53540307.1070708@quietfountain.com> <20140421000122.GS43976@funkthat.com> <53546795.9050304@quietfountain.com> <201404210306.s3L36JfU020865@catnip.dyslexicfish.net> To: Jamie Landeg-Jones X-Mailer: Apple Mail (2.1874) X-MANTSH: 1TEIXWV4bG1oaGkdHB0lGUkdDRl5PWBoaHhEKTEMXGx0EGx0YBBIZBBsdEBseGh8 aEQpYTRdLEQptfhcaEQpMWRcbGhsbEQpZSRcRClleF2hjeREKQ04XSxsYGmJCH2lsG0NcGXhzB xlmGx8YGW1vEQpYXBcZBBoEHQdNSx0SSEkcTAUbHQQbHRgEEhkEGx0QGx4aHxsRCl5ZF2FDXlI FEQpMRhdia2sRCkNaFxISBBsTHwQbGBIEGRkRCkRYFxgRCkRJFxsRCkJFF2Z9fxNNb1xgZRoSE QpCThdrRRpSUB5DXFlcaBEKQkwXbk0deVljZGh+GEYRCkJsF2FAfFNsSx8YZHt+EQpCQBduGE5 kHBhiR1hTcBEKcGcXYXlJfRtueXwTe0MRCnBoF2J9Yh8bRxleR3lvEQpwaBdgZxxTUElMQBpDR BEKcGgXb2lnRkNZeFJeS0MRCnBoF2JMbWlhb3JjYgFrEQpwaBdtWF4YRmJsZkZLRxEKcH8Xbm5 oGhMdQ2AfXW0RCnBfF2VzY01fW2BDaVMaEQpwaxdhGgF9W3B8fRltRxEKcEsXYmlyE1hdXGdtU 3MRCnBrF2QfTR4cGmljRVhEEQpwbBdtZ24FH2FOYRxbGxEKcEwXemVMfEdfX1wceHIR X-CLX-Spam: false X-CLX-Score: 1011 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.11.96,1.0.14,0.0.0000 definitions=2014-04-21_02:2014-04-21,2014-04-21,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=10 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1404210253 Cc: freebsd-security@freebsd.org X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Apr 2014 15:23:31 -0000 --Apple-Mail=_5ACB6A6C-91B4-4C5D-A5BA-DAE79AA198E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 On 21.4.2014, at 6.06, Jamie Landeg-Jones = wrote: > "hcoin" wrote: >=20 >> local variables) harms performance. It's also true doing both of = these=20 >> things would not fix the flaw that 'opened the window' onto these = data. =20 >> However it is true that doing so would make the exploit valueless as=20= >> 'opening a window' onto erased data would reveal nothing and could = erase=20 >> trojan/virus 'hijack via code-injection then trampoline' = opportunities. >=20 > In the heartbleed case, was the bug returning stale freed memory, = though? > Couldn't it just as easily have been that the over-read was returning = any > other memory that the process has had allocated for other variables - = data > that was still in use? No, the problem was another type of programming error that is endemic in = C programming. It=92s called failure to validate input parameters before = using the input parameters or derived values from the input parameters = as array indices.=20 https://en.wikipedia.org/wiki/Bounds_checking The bug allowed an attacker to request any number of bytes from memory = that followed the buffer that the client was usually allowed to access = (depending on how the index was interpreted it might have been possible = to request memory before the buffer as well). The part of memory that = followed the buffer very probably contained some very sensitive = information, possibly secret keys that were loaded in memory (memory = that was constantly in use and not free()=92d until the process = terminates) in unprotected form (plain text essentially) for fast access = during encryption and decryption. -Kimmo --Apple-Mail=_5ACB6A6C-91B4-4C5D-A5BA-DAE79AA198E4 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJTVTfeAAoJEFvLZC0FWRVpHfMIAKPW0sIvgfGv2BlTdyw5lADB MPWXB/P3E7HGfY5gKCrn7X2XOgdv6omg9WvZqS5WhRdFXM4MEAMYQBstgEP9mJgu N9RXCbhic08vQDWQdmGcGyh9tknPlitilYiRpMZ2yMCAbU6dan0GRP0fxYUeqaWn iK+j2f4gF8KJl0XPPCd3f3pC08LoNGCLV61yClJJ8R/fv5T6GX79oBQrwLslmzjR TB0i1DDLALuhXqAVxQtRDqcZHAJMha3Y1oxW/UQL79UfcKE9JDjvNrN7lhPotuCq UHWg0dhVa05ocFM0tDNNtpQ1R3ik26vCLA4T/Q9nlVERBAVGLCsm0iIWj3R9yms= =Lk0k -----END PGP SIGNATURE----- --Apple-Mail=_5ACB6A6C-91B4-4C5D-A5BA-DAE79AA198E4--