From owner-freebsd-security@freebsd.org Tue Jun 20 19:41:20 2017 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 92EF5DA094E for ; Tue, 20 Jun 2017 19:41:20 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4783F70C1E for ; Tue, 20 Jun 2017 19:41:20 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qk0-x232.google.com with SMTP id r62so66287122qkf.0 for ; Tue, 20 Jun 2017 12:41:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=3+vPmeuE6zQTpHKTiC22XNpNzCgGOpyj+a5IYBHFPao=; b=mBvs75FkaN6KNRUPp9HL2ItAuUcrDleQ2Ptq4/nYYi/PD6pOTfXn9EKOotQbDItT+v GwzT/S6Li/zGIizuy00pwM3loBKCc38NcbKn2loy6a9W4bjmQzIf6/pXZfKpmNXbwLPj wEjmpiDuD67FN2RKx+3y2jZMAwWP17tXUsXwTFrSutGvdxOdWsYXwa9Sk8IaRQTbNl/I vMm6+w3xx3+BxVOZnUAmIKLHveZwLgv3eEbfVKiyVZMYB8DivHLo/BVgVnL8sqVULMsg d24VXvzhyMI0RBqHunNiCotcfnFrToXnx2M4Dz33idSigYfyzxl3NouYGzC7Q2+KU0sF D/nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=3+vPmeuE6zQTpHKTiC22XNpNzCgGOpyj+a5IYBHFPao=; b=n6Pl+pm6Zx9Si9ulbdTwXK6pf7ad07JrofkgbtQ5eEL0p5qatOeuFyjF4vhZ52Z3uP 7MBrrAiSZ+p+Uv7PEb1PmYTq13ypG3L41blsXsEw9CvgHQhI3gWEC/lJZU23JZEU4Fh4 QNLZiKC3dHOtFhFSsBPShRSN14ONxkiMmIPgv34FLmhC1k2PVDbrDw6xQegpF8TFEeVu kLtgP+9qDFFb5uUme8G+pgnsQcTH+BRSWNk81Skj4fjR8JDo1gDXLs1xK5+wvwH/oWQv KzHSs/Fgs2dg/7IMoe6Df7vMyWoLVoOhASVvU+aGsT78zD+aquWMZ1W0vB1osYIJik9J c7Cw== X-Gm-Message-State: AKS2vOzdDftVsPSCGTmPpQFECeBsUbYF/Fkf40Tomf5F0U63QniymR5t MVkJGnoavuW6IdLNiwt2sQ== X-Received: by 10.55.71.20 with SMTP id u20mr29774301qka.66.1497987679203; Tue, 20 Jun 2017 12:41:19 -0700 (PDT) Received: from mutt-hbsd ([63.88.83.66]) by smtp.gmail.com with ESMTPSA id t42sm9352574qtg.43.2017.06.20.12.41.18 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 20 Jun 2017 12:41:18 -0700 (PDT) Date: Tue, 20 Jun 2017 15:41:17 -0400 From: Shawn Webb To: Vladimir Terziev Cc: "freebsd-security@freebsd.org" Subject: Re: The Stack Clash vulnerability Message-ID: <20170620194117.45yggu3qvfidtybo@mutt-hbsd> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="wwmflklaohoqymjp" Content-Disposition: inline In-Reply-To: X-Operating-System: FreeBSD mutt-hbsd 12.0-CURRENT FreeBSD 12.0-CURRENT X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: NeoMutt/20170428 (1.8.2) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Jun 2017 19:41:20 -0000 --wwmflklaohoqymjp Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Jun 20, 2017 at 08:13:46AM +0000, Vladimir Terziev wrote: > Hi, >=20 > I assume FreeBSD security team is already aware about the Stack Clash vul= nerability, that is stated to affect FreeBSD amongst other Unix-like OS. >=20 > Just in case here is the analyses document of Qualys: >=20 > https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt As a follow-up, Stack Clash should now be mitigated in HardenedBSD: https://github.com/HardenedBSD/hardenedBSD/compare/de8124d3bf83d774b66f62d1= 1aee0162d0cd1031...91104ed152d57cde0292b2dc09489fd1f69ea77c Thanks, --=20 Shawn Webb Cofounder and Security Engineer HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --wwmflklaohoqymjp Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEKrq2ve9q9Ia+iT2eaoRlj1JFbu4FAllJelsACgkQaoRlj1JF bu6uDg/9G2g12odIKpsFi7SW3WLocpL2Qf9ArM0qWxb8cG81rv+w4v8uli2UPMue c38V4Gq5hpQfXIF0TCE1nr35uWFoGTqjz6bsVBFvEytnPzOhGF3NdBPeL9kJDdae 2XTt1r6fDrlGGLPg7vBWCYkrK+0/XuDV2e7Nq8NjfJn2rk1Yi9TXOLdG0ILs7xaV ptmWtdXWXIRR0kW2RiE3BJNs79KITs1y0fCBc1WJfPZGcHjZW7cvMxE3z+OOnr4k GvCbfi7NCi/oTOPbQ8L8rBbCNCicXOqHfbRa7WJCs5L7IyCIHaQ6uHyMdBeavD5A ce7QF7z9+WFLD7EUldnJR3I6t0fLDfGpnDj5ulsus9Xsqif0Ec8LtK3UzXHbP20t 7PpDTpDrwhhW/s6XpTXugC12gLpluctcSztzNcwbGUpTtCnyYQoQ5cvVSad8ggoz 9xWTvNXijenkcc/IQzeiV0fEuB1eP2Dh4QG/YuNhi5LNbg5ZLB3zSElddFSF0KL3 RUuS3KGg8T8fc0/qgRTf5CeNJggNNPN1LSVro7irgAhc+o979q+HJQIc4zqYcQVm mhxNdB0DBAusdVOCJp4zKMaTgTFQzR1yiYZpMJrw5fjej5KupcfrY1sbSANdqAY4 tE3CG9wVbAjB0hipNihUZtpDwFbbUg5+aB5WDfDoGUg27wI1tTM= =XTy7 -----END PGP SIGNATURE----- --wwmflklaohoqymjp--