grsecurity in all Debian templates implemented
MITIGQW3 · Implemented: In place. · Defined in mitigations.py:751
Applied: Yes (except sys-net, sys-firewall and sys-usb) Tracking: https://github.com/freedomofpress/securedrop-workstation/issues/113
Threats it mitigates
| Threat | Status | Risk | After mitigations |
|---|---|---|---|
| Known vulnerability in any VM template THREATQW22 | mitigated | 12 high | 6 medium |
| Vulnerability introduced to AppVMs via Template dependency THREATQW58 | partially mitigated | 6 medium | 6 medium |
| Attacker obtains code execution in any VM THREATQW36 | partially mitigated | 6 medium | 4 medium |
| Unknown vulnerability in a VM template THREATQW10 | mitigated | 6 medium | 3 low |
| Privilege escalation (Xen vulnerability) THREATQW11 | accepted | 6 medium | 3 low |
| Attacker obtains code execution in the sd-app VM THREATQW18 | mitigated | 6 medium | 3 low |
| Adversary exploits gzip parsing to get code execution THREATQW37 | accepted | 3 low | 2 low |
Possible further mitigation for
| Threat | Status | Risk | After mitigations |
|---|---|---|---|
| Attacker obtains code execution in the Network VM THREATQW17 | partially mitigated | 2 low | 3 low |
| Attacker obtains code execution in sd-viewer VM THREATQW1 | partially mitigated | 9 high | 2 low |
| Attacker obtains code execution on sd-gpg VM THREATQW5 | partially mitigated | 4 medium | 2 low |
| Attacker obtains code execution in the Firewall VM THREATQW4 | partially mitigated | 2 low | 2 low |