Bug 2279678

Summary:	Missing automatic memory initialization: enable CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
Product:	[Fedora] Fedora	Reporter:	jvoisin <julien.voisin+fedora>
Component:	kernel	Assignee:	Kernel Maintainer List <kernel-maint>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	40	CC:	acaringi, adscvr, airlied, alciregi, bskeggs, hdegoede, hpa, jarod, josef, kernel-maint, linville, masami256, mchehab, ptalbert, steved
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel-6.8.10-200.fc39 kernel-6.8.10-300.fc40	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-05-22 01:21:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description jvoisin 2024-05-07 23:07:36 UTC

1. Please describe the problem:
It's currently ~trivial to leak memory from the heap on fedora. Enabling CONFIG_INIT_ON_ALLOC_DEFAULT_ON would make it arguably harder for attacker to produce reliable exploits.

It's enabled by default on Android (https://source.android.com/docs/security/test/memory-safety/zero-initialized-memory) and Debian/Ubuntu ( https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/jammy/tree/debian.master/config/annotations#n14162), and is recommended by the KSSP (https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings).

It does break some real-life exploits, like https://github.com/Notselwyn/CVE-2024-1086 and https://github.blog/2022-06-16-the-android-kernel-mitigations-obstacle-race/, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-3773, …

2. What is the Version-Release number of the kernel:

N/A

3. Did it work previously in Fedora? If so, what kernel version did the issue
*first* appear? Old kernels are available for download at
https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :

4. Can you reproduce this issue? If so, please provide the steps to reproduce
the issue below:

Yes, rebuild with `CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y` and notice that nothing breaks except some public exploits.

5. Does this problem occur with the latest Rawhide kernel? To install the
Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
``sudo dnf update --enablerepo=rawhide kernel``:

N/A

6. Are you running any modules that not shipped with directly Fedora's kernel?:

No.

7. Please attach the kernel logs. You can get the complete kernel log
for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
issue occurred on a previous boot, use the journalctl ``-b`` flag.

N/A

Reproducible: Always

Comment 1 Fedora Update System 2024-05-18 15:17:13 UTC

FEDORA-2024-92664ae6fe (kernel-6.8.10-300.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-92664ae6fe

Comment 2 Fedora Update System 2024-05-18 15:17:41 UTC

FEDORA-2024-49fcf86f58 (kernel-6.8.10-200.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-49fcf86f58

Comment 3 Fedora Update System 2024-05-19 02:11:13 UTC

FEDORA-2024-49fcf86f58 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-49fcf86f58`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-49fcf86f58

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2024-05-19 03:01:52 UTC

FEDORA-2024-92664ae6fe has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-92664ae6fe`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-92664ae6fe

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2024-05-19 03:08:23 UTC

FEDORA-2024-88abd103c8 has been pushed to the Fedora 38 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-88abd103c8`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-88abd103c8

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2024-05-22 01:21:15 UTC

FEDORA-2024-49fcf86f58 (kernel-6.8.10-200.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2024-05-22 01:26:56 UTC

FEDORA-2024-92664ae6fe (kernel-6.8.10-300.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.