KERNSEAL makes the linear page cache overflow in cyberstan.co.uk/fuse-readdir… deterministically unexploitable. Serial log below 👇

Under a system with LUKS (af_alg loaded at boot) and a non-RHEL-derived config, exploitation will fail as an unprivileged user as follows:

If your kernel configuration is based on any major distro kernel configuration however and GRKERNSEC_MODHARDEN is enabled (as is done by default via auto-config) and algif_aead was not loaded as a module by a privileged user, exploitation is not possible by an unprivileged user:

Nice demo: tested a vulnerable Ubuntu 22.04 system for glibc CVE-2025-4802 using @solardiz's PoC adapted to Ubuntu (replace any occurrence of "myhostname" with "mdns4_minimal"). Even an old #grsecurity 5.4.96 kernel from February 8 2021 prevented exploitation

We need to post a correction to yesterday's eBPF performance numbers: @_minipli wasn't happy with just a 30x speedup and took a look at one final bottleneck that was bothering him. The speedup over vanilla is now 747x 🤯 (5.27s vs 1h5m40s)

Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!

Based on a tailored analysis for a kernel with nftables disabled (# CONFIG_NF_TABLES is not set), it correctly recognizes CVE-2024-27397 being irrelevant. And so you don't have to "just trust it", full analysis artifacts are provided.

A short Friday afternoon blog announcing a new version of paxtest with some useful new tests to get you ready for Monday! grsecurity.net/paxtest_relea…

We are and will continue to be loudly opposed to the effective destruction of a system that, while flawed, is used by the entire security industry and is found useful by many. Until the decision gets reverted, we'll be part of the solution for our current (and future) customers.

If you disabled the anti-bruteforcing option that we've had since 2002 (21 years ago!, prior to that 2004 advisory) which has always been a required component of ASLR, even if others still haven't gotten the message: github.com/linux-scraping/gr… pax.grsecurity.net/docs/aslr…

A user of ours who is also a Proxmox customer shared the following graph with us. Prior to the break is an older grsecurity kernel, after includes the KVM performance improvements we mentioned in our previous tweet. The improvement is obvious and significant!

Here's another example from today (git.kernel.org/pub/scm/linux…), handled automatically in Respectre since 2018:

#grsecurity's RESPECTRE is a compiler-based approach to eliminating many more Spectre instances than are manually resolved in the Linux kernel. To demonstrate, here's part of its verbose log, showing having already instrumented the same two locations manually fixed upstream now.

Slides for @wipawel's presentation last weekend at @h2hconference are now available at grsecurity.net/papers Learn how your CPU really works and what recent speculative execution vulnerabilities make possible.

The automated binary analysis system @wipawel created has been very useful in validating Retbleed fixes and resolving objtool warnings. The below image shows an IDA DB automatically generated from our CI system demonstrating our Rethunk plugin adding the proper jmp SLS barrier.

Today we present deep research from our @wipawel into the branch predictor of AMD CPUs and abusing its behavior to exploit Spectre v1 much more easily than previously understood, culminating in reproducing an arbitrary kernel mem leak PoC in only 3 days. grsecurity.net/amd_branch_mi…