PaX Team

[PaX Team @paxteam]

the colored lines are for 1/2/3 monitors of the same resolution

[PaX Team @paxteam]

planning your next monitor setup for coding? this table might come handy. the UHD/100%/125% data was actually measured with Source Code Pro (Regular weight), the rest is extrapolated and YMMV of course.

[PaX Team @paxteam]

@spendergrsec not in that time, but days ago, sorry ;)

[PaX Team @paxteam]

@andersonc0d3 @0xAX slab is just one user of the buddy allocator, and while the first few buddy pages go to the kmem_cache{,_node} caches, it soon becomes the usual fight over resources with many other buddy users.

[Brad Spengler @spendergrsec]

About time someone said what needed to be said: https://t.co/n0o7jXvF1E

[PaX Team @paxteam]

While we did this for security purposes, you don't have to be security-oriented, this is generic OS research.

[Brad Spengler @spendergrsec]

We are looking for a PhD student intern this summer to research optimal heuristics for a new feature of ours that provides finer-grained, context-aware control over fragmentation in the Linux buddy allocator. Fully remote, please email hiring@ if interested.

[grsecurity @grsecurity]

Slides for @wipawel's H2HC presentation this month on the TLB are now available on https://t.co/XxQrdIDwDC
If you've never heard of "paging-structure caches" before, check it out!

[PaX Team @paxteam]

@bsdaemon thank you for everything!

[Pawel Wieczorkiewicz @wipawel]

Our analysis of Intel CAT feature as a cache side-channel mitigation. Tl;dr don’t. @bsdaemon https://t.co/XJ3wyKR8AF

[grsecurity @grsecurity]

We need to post a correction to yesterday's eBPF performance numbers:

@_minipli wasn't happy with just a 30x speedup and took a look at one final bottleneck that was bothering him.

The speedup over vanilla is now 747x 🤯 (5.27s vs 1h5m40s)

[grsecurity @grsecurity]

Performance isn't the enemy of security: we care about both. Today's patches finish off a set of security/performance improvements to eBPF. Below we show a ~30x speedup vs vanilla in running the eBPF selftests with every single #grsecurity option enabled!

[johannes @wiknerj]

The first ever end-to-end cross-process Spectre exploit? I worked on this during an internship with @grsecurity! An in-depth write-up here:
https://t.co/mze3LQkpJR

[PaX Team @paxteam]

not to mention that it's all nicely documented at https://t.co/G2b1QUqw2n and https://t.co/WlOyyukcr1 :)

[Brad Spengler @spendergrsec]

Actually, don't even need that, as found by @paxteam, just need to use the proper no_sanitize() attribute. Replace the first line in the test at: https://t.co/6VK5TUSyXL with: #define __nsa __attribute__((no_sanitize("hwaddress", "kernel-hwaddress")))

[Brad Spengler @spendergrsec]

No takers, so here's a full timeline of CVE-2024-26972 and how the Linux CNA's automation produces garbage that people act on (posting in 20 Xcretes would be a pain): https://t.co/c8EClHNUBR

[grsecurity @grsecurity]

In today's blog post, @_minipli shows how we were able to use a newer C feature and a GCC plugin addition to ease our maintenance burden, reducing grsecurity's patch size by over a megabyte with no change in functionality. Enjoy! https://t.co/0LAuNxtIYz

[Brad Spengler @spendergrsec]

A little peek at a subset of our oops-enrichment capability too

[grsecurity @grsecurity]

In this blog, we dive deep into how the automation employed by the recently-formed Linux CNA managed to take a detailed, unrestricted vulnerability report for their 5.10 LTS kernel, and produce an error-filled CVE unhelpful for downstream consumers: https://t.co/PSLcvFDFgd

[PaX Team @paxteam]

@spendergrsec we had a blog about it even: https://t.co/NUVMeEZ9Jj

[Brad Spengler @spendergrsec]

Thank you, Peter, for this concise description of the PAX_SIZE_OVERFLOW GCC plugin! Created in 2012, it was one of the first GCC plugins added to grsecurity. It was very advanced for its time, and in 2024, still is: https://t.co/OMwlhIHCVv

[PaX Team @paxteam]

@domosauce not windows and as someone kindly reminded me, it wasn't meant for you but @dekeneas, my mistake :).

[PaX Team @paxteam]

@domosauce check out https://t.co/srqOzwmEvU and see if you can find the part that should ring a very old bell? :)