oss-sec mailing list archives
Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode
From: gremlin () gremlin ru
Date: Thu, 14 Mar 2013 10:32:59 +0400
On 13-Mar-2013 15:54:15 +0400, gremlin () gremlin ru wrote:
http://lkml.indiana.edu/hypermail/linux/kernel/0012.2/0502.htmlYes, I've found that while investigating the possible impact. Also, the random.c doesn't use the data directly, but instead hashes it.
And that has some impact: the malicious (or just curious) unprivileged user may run flood the devices with garbage, and the kernel will spend resources hashing it. Try this: `dd bs=1M if=/dev/zero of=/dev/urandom` On a Core i5-2400 3.10GHz CPU, only 16 processes running for several minutes result in all cores loaded at 99% and the load average of 20. My workstation has survived the experiment, but heavy-loaded servers may dislike that :-)
But my opinion stays exactly the same: devices should be 0644, and only trusted random data sources should be used to add entropy to the pool via add_device_randomness(). So, I'll just restrict the access to /dev/{,u}random locally :-)
... and recommend others do the same. -- Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru> GPG key ID: 0xEF3B1FA8, keyserver: hkp://subkeys.pgp.net GPG key fingerprint: 8832 FE9F A791 F796 8AC9 6E4E 909D AC45 EF3B 1FA8
Attachment:
_bin
Description:
Current thread:
- Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode gremlin (Mar 13)
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode Tim Brown (Mar 13)
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode Eduardo Tongson (Mar 13)
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode Pavel Labushev (Mar 13)
- <Possible follow-ups>
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode gremlin (Mar 13)
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode gremlin (Mar 13)
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode Kurt Seifried (Mar 14)
- Re: Linux kernel + devtmpfs automount == insecure /dev/{,u}random mode gremlin (Mar 13)