Re: stack-clash implications

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--W8SgAtrF6JiNMMxwUMQg7qxII3CxUuf7f
Content-Type: multipart/mixed; boundary="i4FDbBEKAHRxH7qmrXtoufwApTw5pAJsK"
From: "Francisco Blas Izquierdo Riera (klondike)" <[email protected]>
To: [email protected]
Message-ID: <853fe86a-ccc3-081f-aa8b-586a080fe43e-aBrp7R+bbdUdnm+yROfE0A@public.gmane.org>
Subject: Re: [gentoo-hardened] stack-clash implications
References: <f6612ce2ad1aee7df54bbbf5775dcb95.squirrel-J1cgac+wqeJaB7pSnPOuKA@public.gmane.org>
In-Reply-To: <f6612ce2ad1aee7df54bbbf5775dcb95.squirrel-J1cgac+wqeJaB7pSnPOuKA@public.gmane.org>

--i4FDbBEKAHRxH7qmrXtoufwApTw5pAJsK
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

El 21/06/17 a las 01:02, "T=C3=B3th Attila" escribi=C3=B3:
> https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
> The advisory suggests:
> 1. Increase the size of the stack guard-page to at least 1MB
> - I skip this point
> 2. Recompile all userland code with GCC's "-fstack-check" option
> - I checked current and recent gcc versions.
>
> 6.3.0 seems to be fine:
> gcc version 6.3.0 (Gentoo Hardened 6.3.0 p1.0)
> gcc -dumpspecs | grep -B 1 stack-check
> *cc1:
> %{!mandroid|tno-android-cc:%(cc1_cpu) %{profile:-p};:%(cc1_cpu)
> %{profile:-p} %{!mglibc:%{!muclibc:%{!mbionic: -mbionic}}}
> %{!fno-pic:%{!fno-PIC:%{!fpic:%{!fPIC:
> -fPIC}}}}}%{fstack-check|fstack-check=3D*:;: -fstack-check}
>
> 5.4.0 also looks fine:
> gcc version 5.4.0 (Gentoo Hardened 5.4.0-r3 p1.3, pie-0.6.5)
> gcc -dumpspecs | grep -B 1 stack-check
> *esp_cc1_ssp:
> %{!fno-stack-protector: %{!fno-stack-protector-all: %{!fno-stack-check:=
 }}}
> --
> *esp_options_ssp:
> %{nostdlib|ffreestanding|fno-stack-protector|fstack-protector|         =
  =20
>      fstack-protector-all|fstack-protector-strong:;:-fstack-protector-a=
ll}
> %{fstack-check|fstack-check=3D*:;: -fstack-check}
>
> I assume it is OK like this.
> Please confirm this conclusion.
> Thx: Dw.

Stack-check is enabled since (at least) 4.8.4. But you'll need to have
recompiled the whole system with stack-check enabled so it will work as
it should as commented on
https://gcc.gnu.org/ml/gcc-patches/2017-06/msg01343.html

I'm working on preparing a statement we can publish on behalf of the
project, but I'm unsure when it'll be ready.



--i4FDbBEKAHRxH7qmrXtoufwApTw5pAJsK--

--W8SgAtrF6JiNMMxwUMQg7qxII3CxUuf7f
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIxBAEBCgAbBQJZSatRFBxrbG9uZGlrZUBnZW50b28ub3JnAAoJEPS90u/o/3j5
0KsQAKaoFYMy14fH9gVzY7moFjbKyuzJcApAq6/9H5oT3BnjoaQDcxUcIdbQ6ZTV
ZT7y7TaQ+gKHeQQEjCQDAKOKBcZSIUb+CaqQkjz0y7BgWenMkgdzrQy8DOddDQ8A
ygHFykCg9Kl9aSsLWi+o4O0Jvw4iwHPfFQBsfLE5P9IcJDiBPpGUHGvW+Yde62bG
J+Hz0s2eJ2BgbABkQV9PpnooR1tWvGe1ptFyxgGbcKo0dF0TTa/R1BgslaQe22xM
tU1GL8ZsPEevatYpo1V7mgyTZt658rPMks5H0/isged5KlhSGLOug9AW9a1ivuiA
efSAz+GdLmgdLDt0ZA7BU7Z9uIpqribzMxDkkE3w3XO1louDXn/g2sRqCUygvZVq
wEapqHBMQkMEbXHqhys4tyInGEkFll2jRVQPPVSzBPEmZ0Rc/B3zxAd+2DHwWryN
/8QhvBkIn42+TUs3d6F9/YhbKGPjMcu5zfbqCvvFYsGlr9HQ2ytY3sEiVKzJoNA0
lJ+2z0xtmBEbAj/1vpzyL7prLMmUUwcFLMA/zz4k3DmH/z2ggPNg5cDWoEtXj9+h
Xap6w5BvMatErmO2fZrdoXRPQDFXMGr2nnZopmJVK1JWUd8Ah520ifcXZQFWOr16
EUlFVaHOIXmTqaLw0Qlb1WT6I3pmfsQ1+HB3bTPKAf8krE7N
=o5eS
-----END PGP SIGNATURE-----

--W8SgAtrF6JiNMMxwUMQg7qxII3CxUuf7f--