| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20101109221704.GX5876@outflux.net> Date: Tue, 9 Nov 2010 14:17:04 -0800 From: Kees Cook <kees.cook@...onical.com> To: x86@...nel.org, linux-kernel@...r.kernel.org Subject: [Security] [PATCH v4 0/4] x86: clear XD_DISABLED flag on Intel to regain NX Resending with updates to commit messages and Pekka Enberg's Acks. Intel CPUs have an additional MSR bit to indicate if the BIOS was configured to disable NX. This bit was traditionally used for operating systems that did not understand how to handle the NX bit. Since Linux understands this, this BIOS flag should be ignored by default. In a review[1] of reported hardware being used by Ubuntu bug reporters, almost 10% of systems had an incorrectly configured BIOS, leaving their systems unable to use the NX features of their CPU. This change will clear the MSR_IA32_MISC_ENABLE_XD_DISABLE bit so that NX cannot be inappropriately controlled by the BIOS on Intel CPUs. If, under very strange hardware configurations, NX actually needs to be disabled, "noexec=off" can be used to restore the prior behavior. -Kees [1] http://www.outflux.net/blog/archives/2010/02/18/data-mining-for-nx-bit/ --- Changelog: v2 - rearranged use of verify_cpu() v3 - resent, show stats on systems that need it v4 - expanded commit messages, added acks -- Kees Cook Ubuntu Security Team -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists