Jann Horn
jann@infosec.exchange
<p>human borrow checker (but logic bugs are best bugs).<br />works at Google Project Zero.</p><p>The density of logic bugs (compared to memory corruption bugs) goes down as the privilege differential between attacker context and target context goes up.</p>
Posts
-
Post #4449508
I think it would be nice to have an OS that is centered around the idea of "everything that could possibly be a cache is a cache". Which I guess is sort of a functional programming idea? The pixels of your GUI: Cached result of running the immediate-GUI-rendering application code on the application state. The pixels of an image in the GUI: Cached result of PNG-decoding a PNG image, which is cached from an image on disk or elsewhere. Text written into a text input field: Writeback-cach...
-
Post #4382166
fun Linux fact: Using epoll, you can see from userspace when the in-kernel garbage collector for unix domain sockets is cleaning up unreachable reference loops formed by SCM_RIGHTS. epoll essentially holds weak pointers on watched files (no refcounted reference, instead epoll gets a hook call when the refcount drops to 0); and /proc/self/fdinfo/{epoll fd} shows which files are currently watched by epoll, with files automatically disappearing when their refcount drops to 0.
-
Post #4378667
@axboe@fosstodon.org I've seen people wanting to use io_uring for bulk data transfer and I'm wondering - is my understanding correct that io_uring is mainly useful for usecases with concurrency, or cases where syscall batching helps? While if you're just trying to shovel a large amount of data from one FD to another FD, sendfile() should do the job?
-
Post #4200337
The combination of Linux stable backports and not having explicitly documented and enforced API contracts is so annoying. Write a bugfix that uses an existing helper function that can return error type A. Your bugfix gets backported to an old kernel. Surprise, in the old kernel, the helper function can also return error type B. And suddenly your bugfix causes more breakage.
-
Post #3969311
Fun Linux fact: If you race dup(5) and close(5), the kernel handles that fine, but it can lead to the unusual result that dup(5) returns 5.
-
Post #3969054
Fun Linux fact: On a Linux system where /tmp/ is tmpfs, if you create the following directories: /tmp/pathwalktest/tmp/pathwalktest/a/tmp/pathwalktest/a/b/tmp/pathwalktest/c and call rename("/tmp/pathwalktest/a/b", "/tmp/pathwalktest/b") then a concurrent open("/tmp/pathwalktest/a/b/../c", O_RDONLY) normally won't end up opening /tmp/pathwalktest/c. But a concurrent open("/proc/self/root/tmp/pathwalktest/a/b/../c", O_RDONLY) can end up doing th...
-
Post #3727511
there is a recipe website with a "baking mode" toggle that uses the Screen Wake Lock API so the screen doesn't turn off while you have dough all over your hands and that just feels like such a nice little detail
-
Post #2500058
this sounds exciting, nice that AMD found it: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html AMD has identified a vulnerability in the CPU operation (op/µop) cache on Zen 2‑based products that can cause incorrect instructions to be executed at a higher privilege level. [...] Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially...
-
Post #1098827
from the Security Cryptography Whatever podcast, talking about openssl API design choices: https://youtu.be/jhdLja5mWbU
-
Post #1098826
oh, this sounds like an exciting Xen &gt;=4.17 bug affecting HVM/PVH modes: "Use after free of paging structures in EPT" https://xenbits.xen.org/xsa/advisory-480.html
-
Post #1098825
I'm currently learning British English slang from a british isekai, no way this could go wrong
-
Post #1098824
aah, the reason why the in-app kindle purchase flow in german has a button labeled "Bitte lesen" (which translates to "Please read") for opening the purchased ebook is that someone mistranslated "Read now" as if it was meant in imperative form? My favorite out-of-context translation fail was some internal status page in Chrome years ago, which described sandboxing status as (translated back to English) "you have trained sufficiently".
-
Post #656581
I find stack overflow security bugs fascinating; and on Linux, compilers still don't protect against stack overflows by default when stack frames are bigger than stack guard pages. So I went looking around in Android, and thanks to how Android's RPC mechanism allows recursive synchronous callbacks in some cases, I managed to find a way to jump a thread guard page in system_server from shell context and (with very low success rate) get instruction pointer control: https://project-zero.is...
-
Post #337551
The Linux kernel "every subsystem has its own git tree" thing is so annoying. Especially when one file is plausibly associated with multiple subsystems and patches get routed through more than one. I guess it probably works reasonably well for people who only ever touch stuff in the one subsystem they specialize in, but for anything else...