Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sun, 3 Feb 2019 22:35:44 +0800
From:   Tom Li <tomli@tomli.me>
To:     Chris Rankin <rankincj@gmail.com>
Cc:     linux-kernel@vger.kernel.org
Subject: Re: [BUG] What is "__ptrval__" in my dmesg logs? Bad "%p" expansion?
Message-ID: <20190203143544.GA24267@localhost.localdomain>
References: <CAK2bqV+YhN7L=NYOMEkOvzRSa7-p51RnsRxR_=inNt+6OcsKvw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAK2bqV+YhN7L=NYOMEkOvzRSa7-p51RnsRxR_=inNt+6OcsKvw@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

This is not a bug, rather, this is a security feature that fixes
the original behavior, which is now considered an infoleak vul-
nerability.

Currently, the address of internal data structures are protected
by Kernel Address Space Layout Randomization (KASLR), it forces
attackers to bruteforce the location they need to overwrite, thus
together with W^X mappings, increases the difficulty of exploiting
the kernel. However, showing values of raw pointers will reveal an
address of a known internal data structure, allowing an attacker to
calculate the location of critical data structure within the kernel,
therefore completely defeating the protection by ASLR. This is why
disallowing normal users to "dmesg" used to considered a way to
improve system security.

As a security measure, the value of "%p" is now hidden by default.

Happy Hacking,
Tom Li