linux-kernel - Re: Using x86 segments against NULL pointer deference exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.00.0911071118350.31913@twin.jikos.cz>
Date:	Sat, 7 Nov 2009 11:20:07 +0100 (CET)
From:	Jiri Kosina <jkosina@...e.cz>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	castet.matthieu@...e.fr, linux-kernel@...r.kernel.org
Subject: Re: Using x86 segments against NULL pointer deference exploit

On Fri, 6 Nov 2009, H. Peter Anvin wrote:

> Yes, it is.  On 32 bits it is possible to switch around segments and do 
> this (in which case you want it to only cover the actual kernel area, 
> and use USER_DS for all user-space references.)  This also lets you drop 
> nearly all pointer-range checks, since they are now redundant.  
> However, there is a cost -- it pretty much requires a segment register 
> for USER_DS (this used to be fs once upon a time, hence set_fs) and 
> probably would break Xen and possibly other virtualization solutions.

There are ways to work around this though (UDEREF implementation of this 
technique in PaX explicitly checks for VMWare signature and handles such 
case differently ... I guess the same could be done for other 
virtualization solutions).

Not that it would be particularly nice of course ... 

-- 
Jiri Kosina
SUSE Labs, Novell Inc.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/