Security Updates in Go 1.1

[Alex]

Now that Go 1.1 is out with non executable heaps, I thought that some others might enjoy reading my write-up of a vulnerability in earlier versions of Go: http://codearcana.com/posts/2013/04/23/exploiting-a-go-binary.html

Would it be possible for someone to briefly describe some of the security features added with Go 1.1? I feel like the non-executable heaps was somewhat buried in the other updates (I couldn't find it in the release notes) and I feel like that was a pretty important step for Go.

Best,
~Alex

[minux]

On Wed, May 15, 2013 at 3:48 PM, Alex <awr...@gmail.com> wrote:

Now that Go 1.1 is out with non executable heaps, I thought that some others might enjoy reading my write-up of a vulnerability in earlier versions of Go: http://codearcana.com/posts/2013/04/23/exploiting-a-go-binary.html

the corresponding issue (https://code.google.com/p/go/issues/detail?id=5336) linked from your article is hidden??

as least i can't access it.

is it deleted or intentionally hidden? i think a fixed security issue should be visible to the public.

Would it be possible for someone to briefly describe some of the security features added with Go 1.1? I feel like the non-executable heaps was somewhat buried in the other updates (I couldn't find it in the release notes) and I feel like that was a pretty important step for Go.

i think the only "security" hardening feature is non-executable heap and stack (because Go 1.1 changed function closure

representation).

[Hans Stimer]

Is a non-executable heap now turned on for all OS's that support the concept, or is there more work to be done to take advantage of this?

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Andrew Gerrand]

On 15 May 2013 02:28, minux <minu...@gmail.com> wrote:

is it deleted

It was originally hidden, then deleted in error by someone being over-zealous.

It didn't contain any more information than Alex's blog post.

Andrew

[Ian Lance Taylor]

On Wed, May 15, 2013 at 7:51 AM, Hans Stimer <hans....@gmail.com> wrote:
> Is a non-executable heap now turned on for all OS's that support the
> concept, or is there more work to be done to take advantage of this?

No more work should be needed. The CL removing the executable heap
was https://codereview.appspot.com/7405045 .

Ian

[Anthony Martin]

For reference, this is the changeset that fixed the issue:

https://code.google.com/p/go/source/detail?r=37bf155b

Anthony

[Hans Stimer]

Excellent. Thank you.

[minux]

On Wed, May 15, 2013 at 11:25 PM, Ian Lance Taylor <ia...@golang.org> wrote:

On Wed, May 15, 2013 at 7:51 AM, Hans Stimer <hans....@gmail.com> wrote:
> Is a non-executable heap now turned on for all OS's that support the
> concept, or is there more work to be done to take advantage of this?

No more work should be needed.  The CL removing the executable heap
was https://codereview.appspot.com/7405045 .

Just discovered that Windows is still using executable heap even in Go 1.1.

[brainman]

On Thursday, 16 May 2013 03:28:24 UTC+10, minux wrote:

Just discovered that Windows is still using executable heap even in Go 1.1.

https://codereview.appspot.com/9235046/ so we don't forget.

Alex