linux-kernel - Re: [PATCH 0/3] Remove interrupt stack table usage from x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 28 Dec 2008 16:09:26 +0200
From:	Avi Kivity <avi@...hat.com>
To:	Andi Kleen <andi@...stfloor.org>
CC:	x86@...nel.org, Ingo Molnar <mingo@...e.hu>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	KVM list <kvm@...r.kernel.org>
Subject: Re: [PATCH 0/3] Remove interrupt stack table usage from x86_64 kernel

(restoring cc list)

Andi Kleen wrote:
> One of the other problems: NMIs and MCEs have the same problem with SYSCALL
>   

This one however looks unsolvable.  Userspace can point %rsp into 
arbitrary memory, issue a syscall, and hope for an nmi.  Since we're in 
cpl 0 and are not using IST, the processor will not switch stacks, and 
the nmi stack frame will corrupt any memory the user chooses to point to.

Even without a malicious user, %rsp could legitimately point at unmapped 
memory.

I don't see how syscall could work on i386, and indeed:

> vdso32.so-$(VDSO32-y)        += int80
> vdso32.so-$(CONFIG_COMPAT)    += syscall
> vdso32.so-$(VDSO32-y)        += sysenter

It's disabled.  Is that the reason?

-- 
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/