[Full-disclosure] Linux's unofficial security-through-coverup policy

[Valdis.Kletnieks at vt.edu]

On Wed, 16 Jul 2008 09:44:37 EDT, Brad Spengler said:

> Please let them know what you think of their policy of non-disclosure
> and coverups.  I hope someone also educates them on their ridiculous
> notion of "untrusted local users" like Greg uses in his announcement of
> the 2.6.25.11 kernel:

What's ridiculous about the concept?  There *do* exist machines that don't
have any untrusted local users - for instance, my laptop.  The only users
on it are me, myself, and I.  My threat model explicitly does *not* include
"One of the other users on the box downloads a vuln and attacks you with it".

Yes, there's *still* an attack surface for me to get whacked by that bug.
However, it's a *much* longer chain for "find a way to get code running on
the box, and then make it do the exploit" than the alternative "the Other User
downloads it and whacks the box".

Yes, there *is* still an exposure to "I get bit in the ass by something that
abuses my web browser or my MUA".  However, that's a *different* issue, as
at that point, they have code running as me - and protecting *my* stuff
from code running *as me* is a different kettle of fish entirely.

At that point, I have other and probably bigger things to worry about than if
my box gets whacked with the bug in 2.6.25.11.  For instance, I worry more
about having a keystroke logger running as me than I do about malicious code
managing to abuse the ldt bug to implement setuid(), simply because the
keystroke logger would be a bigger pain in the ass to clean up after....

Similar reasoning applies to almost all uses of Linux in the embedded
world - if you already have code running on the cell phone, there really
isn't *anything* you can do by abusing something like the setldt() bug
that you couldn't *already* do to the box.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080716/e4268a19/attachment.bin