OpenBSD Journal

OpenBSD Journal

syscall call-from verification

Contributed by rueda on from the hard-as-nails-(in-the-coffin-of-exploit-techniques) dept.

Theo de Raadt (deraadt@) has committed code for a new exploit-prevention mechanism:

[…]
Repurpose the "syscalls must be on a writeable page" mechanism to
enforce a new policy: system calls must be in pre-registered regions.
We have discussed more strict checks than this, but none satisfy the
cost/benefit based upon our understanding of attack methods, anyways
let's see what the next iteration looks like.

This is intended to harden (translation: attackers must put extra
effort into attacking) against a mixture of W^X failures and JIT bugs
which allow syscall misinterpretation, especially in environments with
polymorphic-instruction/variable-sized instructions.  It fits in a bit
with libc/libcrypto/ld.so random relink on boot and no-restart-at-crash
behaviour, particularily for remote problems. Less effective once on-host
since someone the libraries can be read.
[…]

The full commit details are well worth reading, as is the manual page for the (new) msyscall(2), and some associated discussion on tech@.

As this change involves ABI breakage, upgrading via snapshots is the easiest way to avoid trouble.

p2k19 Hackathon Report: Stefan Sperling on iwm(4) wifi progress, more

Contributed by Peter N. M. Hansteen on from the packets-in-the-air dept.

Next up in our hackathon series from p2k19 is one from Stefan Sperling (stsp@), who writes:

My main goal for the p2k19 hackathon was 9260 device support in iwm(4). Firmware updates for previous device generation were an important prerequisite step. One day before p2k19, the oldest generation of hardware supported by the iwm(4) driver was switched to latest available firmware images.

Read more…

Martin Pieuchot: The Unknown Plan

Contributed by Paul 'WEiRD' de Weerd on from the cheese-induced-hallucinations dept.

Fresh from Bucharest is this story from Martin Pieuchot (mpi@) with his experience from p2k19:

Since I attend OpenBSD hackathons, I hear stories about how crazy are the ports hackathons. So I try my best to look like a porter in order to experience this craziness. I must admit p2k19 was awesome but the craziness of port hackathons is still an enigma to me.

Read more…

Donate!

Donate to OpenBSD

Features

We are constantly on the lookout for stories of how you put OpenBSD to work. Please submit any informative articles on how OpenBSD is helping your company.

OpenBSD Errata

OpenBSD 6.6

0112019-12-04 SECURITY xenodm uses the libc authentication layer incorrectly.
0102019-12-04 SECURITY libc's authentication layer performed insufficient username validation.
0092019-12-04 SECURITY Environment-provided paths are used for dlopen() in mesa, resulting in escalation to the auth group in xlock(1).
0082019-11-22 SECURITY Shared memory regions used by some Mesa drivers had permissions which allowed others to access that memory.
0072019-11-22 SECURITY A local user could cause the system to hang by reading specific registers when Intel Gen8/Gen9 graphics hardware is in a low power state. A local user could perform writes to memory that should be blocked with Intel Gen9 graphics hardware.
0062019-11-16 SECURITY A regular user could change some network interface parameters due to missing checks in the ioctl(2) system call.

Unofficial RSS feed of OpenBSD errata

XML/RSS/RDF

Users wishing RSS/RDF summary files of OpenBSD Journal can retrieve: RSS feed

Options are available.

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]