Re: [musl] Re: Compiler support for erasure of sensitive data

[Rich Felker <dalias@libc.org>]

On Wed, Sep 09, 2015 at 12:58:36PM -0400, Zack Weinberg wrote:
> On 09/09/2015 12:52 PM, Paul_Koning@Dell.com wrote:
> > Then again, suppose all you had is explicit_bzero, and an annotation
> > on the data saying it's sensitive.  Can static code analyzers take
> > care of the rest?  If so, this sort of thing doesn't need to be in
> > the compiler.
> 
> The thing that absolutely has to be implemented in the compiler (AFAICT)
> is register clearing.  I'm undecided as to how *necessary* that is.
> There certainly can be a lot of sensitive data in registers (e.g. AESNI
> puts an entire AES key schedule in xmm registers).  I don't know of any
> exploits that depended on salvaging such data from registers, but I
> don't follow exploit research closely.

Conceptually you can "clear all registers" by calling an external asm
function that clears all non-call-saved registers internally. Hardened
implementations of explicit_bzero could even do this. The caller would
(or at least should) not save registers whose old contents it does not
intend to use again after the call. And of course all the call-saved
registers will get restored when the function returns, preventing any
leak via them.

I agree it's much better if the compiler can do it, but I think the
approach I described is a viable hardening technique that's
immediately doable.

Rich