Re: [PATCH v2] nptl: Add backoff mechanism to spinlock loop

[Yann Droneaud <ydroneaud@opteya.com>]

Hi,

Le 26/04/2022 à 14:25, Florian Weimer a écrit :
> * Noah Goldstein:
>
>> On Fri, Apr 22, 2022 at 8:35 AM Cristian Rodríguez via Libc-alpha
>> <libc-alpha@sourceware.org> wrote:
>>> On Fri, Apr 22, 2022 at 9:32 AM Florian Weimer via Libc-alpha
>>> <libc-alpha@sourceware.org> wrote:
>>>
>>>>> As each running threads has its own stack, thread' stack address can
>>>>> be used as a seed for such PRNG.
>>>> We would broadcast the stack address though, which is generally fround
>>>> upon.
>> Why is that?
> Potential bypass of ASLR hardening.

The attack would be to monitor the behavior of multiple threads in a 
process contending for a lock, and get precise timings to recover the 
few bits of each thread stack address that leaked as part of the backoff 
mechanism.

It may sound possible, but I find it unlikely possible without full 
compromise of the running process ....

That said, using the stack address as the key in SipHash, it's 
cryptographically unlikely to recover it from its output, thus no 
exploitable leakage would happen.

Regards.

-- 

Yann Droneaud

OPTEYA