[lkml]   [2013]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 1/9] Known exploit detection
On Fri, Dec 13, 2013 at 02:06:48PM +0100, Ingo Molnar wrote:
> In future the exploit() code could trigger actual active defensive
> measures, such as immediately freezing all tasks of that UID and
> blocking further fork()s/exec()s of that UID.
> Depending on how critical the security of the system is, such active
> measures might still be a preferable outcome even if there's a chance
> of false positives. (Such active measures that freeze the UID will
> also help with forensics, if the attack is indeed real.)

I would recommend adding the CVSS score or some other quantifiable
attribute to the exploit() call, eg:

exploit("CVE-2011-4330", 72);

Or, optionally, maintaining a lut of CVE -> severity number. Then the
user can decide how to respond to different levels of exploits.

So, >80 freezes all tasks of the UID, email user
>30, <80 emails user
<30 just logs it.

I'm swagging this, my point is the user needs a concrete, configurable
way to be alerted / respond.



 \ /
  Last update: 2013-12-13 17:21    [W:0.063 / U:21.704 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site