linux-kernel - Re: [Lguest] [PATCH] lguest: Fix Malicious Guest GDT Host Crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <46BB3692.5010003@vmware.com>
Date:	Thu, 09 Aug 2007 08:45:22 -0700
From:	Zachary Amsden <zach@...are.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
CC:	Linus Torvalds <torvalds@...ux-foundation.org>,
	lguest <lguest@...abs.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	lkml - Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [Lguest] [PATCH] lguest: Fix Malicious Guest GDT Host Crash

Rusty Russell wrote:
> If a Guest makes hypercall which sets a GDT entry to not present, we
> currently set any segment registers using that GDT entry to 0.
> Unfortunately, this is not sufficient: there are other ways of
> altering GDT entries which will cause a fault.
>
> The correct solution to do what Linux does: let them set any GDT value
> they want and handle the #GP when popping causes a fault.  This has
> the added benefit of making our Switcher slightly more robust in the
> case of any other bugs which cause it to fault.
>
> We kill the Guest if it causes a fault in the Switcher: it's the
> Guest's responsibility to make sure it's not using segments when it
> changes them.
>   

Linux doesn't obey that rule.  It changes descriptors behind FS/GS all 
over the place.  Well, not all over the place, only when updating LDT 
entries, TLS entries, and during context switch.  This means lguest 
handling interrupts in one of those regions can result in the guest dying.

Zach
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/