maemo.org - Talk - View Single Post - Android kernel: revealed 359 software defects

	javispedro	2010-11-04 , 18:21
	Posts: 2,355 \| Thanked: 5,249 times \| Joined on Jan 2009 @ Barcelona	#10

Originally Posted by microe

> At most, it is a potential one.

Never, ever marginalize the effect of an invalid pointer in kernel space.

I do marginalize the effectiveness of a static analysis code tool for detecting such issues.

Code:

struct some_interface *c = get_from_global_variable();
some_callback_type f = default_callback();

if (c->do_something(c, &f)) {
   f();
}

What's a static code analysis tool doing to do here? It may
a ) Either detect a "potential NULL dereference", thus indicating that the 5000000 potential bugs found count is pure crap.
b) Do nothing. I do not know which one is worse!
c) Somehow magically deduce all posible code paths and follow them all to detect where the actual bug is. The list of all available code paths does not only depend on hardware configuration but might actually even depend on the current time.

Not to mention the above is a pretty common idiom, specially if, as according to the makers of this tool themselves, "dereferencing function pointers is quite common on the kernel".

Since the last DEFCON showed off an Android remote exploit that only required a minimal amount of user input and a way to create one's own cell that piggy-backs the actual cell, I wouldn't call this a publicity stunt. And coverity ain't cheap

I do not see why a local root exploit would have help here. Specially one where you to exploit you need to get to usually sandbox forbidden functionality such as mmap().

Now on Maemo getting root is usually as easy as running any of the numerous setuid binaries or sudoers-listed programs, so I can understand why it doesn't matter. On other platforms, maybe that's not true. On WebOS at least, _every application_ already runs as root by default, and there was no normal user at all until a recent version.

Now, of course their tools ain't cheap. They're doing a great service to the community IMHO but also getting some free marketing for a tool a decade or two ago would be laughed at.

Note: not saying it is useless; it's as useless as getting a human to do it: they might get it wrong, but "the more eyes...".

Last edited by javispedro; 2010-11-04 at 18:27.

Quote & Reply |

The Following 2 Users Say Thank You to javispedro For This Useful Post:
lma, ysss