Horn: Mitigations are attack surface, too

On the Google Project Zero blog, Jann Horn looksat a number of vulnerabilities in a Samsung Android kernel, some ofwhich are caused by the addition of out-of-tree "security" features."The Samsung kernel on the A50 contains an extra security subsystem(named 'PROCA', short for 'Process Authenticator', with code insecurity/proca/) to track process identities. By combining several logicissues in this subsystem (which, on their own, can already cause a mismatchbetween the tracking state and the actual process state) with a brittlecode pattern, it is possible to cause memory unsafety by winning a racecondition."