This is the mail archive of the
mailing list for the GCC project.
Re: [musl] Re: Compiler support for erasure of sensitive data
- From: Rich Felker <dalias at libc dot org>
- To: Zack Weinberg <zackw at panix dot com>
- Cc: Paul_Koning at Dell dot com, gcc at gcc dot gnu dot org, llvmdev at cs dot uiuc dot edu, libc-alpha at sourceware dot org, musl at lists dot openwall dot com
- Date: Wed, 9 Sep 2015 13:25:26 -0400
- Subject: Re: [musl] Re: Compiler support for erasure of sensitive data
- Authentication-results: sourceware.org; auth=none
- References: <55F05FF1 dot 3000405 at panix dot com> <8228C31E-7E1F-478C-9352-3908E6256B2C at dell dot com> <55F0653C dot 9010903 at panix dot com>
On Wed, Sep 09, 2015 at 12:58:36PM -0400, Zack Weinberg wrote:
> On 09/09/2015 12:52 PM, Paul_Koning@Dell.com wrote:
> > Then again, suppose all you had is explicit_bzero, and an annotation
> > on the data saying it's sensitive. Can static code analyzers take
> > care of the rest? If so, this sort of thing doesn't need to be in
> > the compiler.
> The thing that absolutely has to be implemented in the compiler (AFAICT)
> is register clearing. I'm undecided as to how *necessary* that is.
> There certainly can be a lot of sensitive data in registers (e.g. AESNI
> puts an entire AES key schedule in xmm registers). I don't know of any
> exploits that depended on salvaging such data from registers, but I
> don't follow exploit research closely.
Conceptually you can "clear all registers" by calling an external asm
function that clears all non-call-saved registers internally. Hardened
implementations of explicit_bzero could even do this. The caller would
(or at least should) not save registers whose old contents it does not
intend to use again after the call. And of course all the call-saved
registers will get restored when the function returns, preventing any
leak via them.
I agree it's much better if the compiler can do it, but I think the
approach I described is a viable hardening technique that's