oss-sec mailing list archives
Re: Qualys Security Advisory - The Stack Clash
From: Daniel Micay <danielmicay () gmail com>
Date: Mon, 19 Jun 2017 12:46:20 -0400
On Mon, 2017-06-19 at 09:40 -0600, kseifried () redhat com wrote:
On 06/19/2017 09:28 AM, Qualys Security Advisory wrote:Qualys Security Advisory The Stack ClashI just want to publicly thank Qualys for working with the Open Source community so we (Linux and *BSD) could all get this fixed properly. There was a lot of work from everyone involved and it all went pretty smoothly.
Fixing it properly would really also include fixing these: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68065 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66479 and actually implementing -fstack-check as not just a no-op in Clang. Windows has working stack probes, even in Windows XP and perhaps even earlier. LLVM has working stack probes there (not sure if GCC deals with it properly) yet doesn't make them available elsewhere. Rust is 'memory safe' but has this same stack exhaustion issue. It didn't used to have the issue, since it kept around the LLVM segmented stack code generation after it dropped segmented stacks to check for stack overflow in function preludes. That got dropped for a 1-3% performance win from using stack probes instead... which was a good idea, but without implementing stack probes... making it a terrible idea. It was deferred to some later date. That was in July 2015, and 2 years later it's not done.
Current thread:
- Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Marcus Meissner (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 20)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash nospam (Jun 21)
- Re: Re: Qualys Security Advisory - The Stack Clash Franz Pletz (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 25)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 28)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Josh Bressers (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 21)