lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 17 Jan 2012 21:23:51 -0800 From: Linus Torvalds <torvalds@...ux-foundation.org> To: Indan Zupancic <indan@....nu> Cc: Andi Kleen <andi@...stfloor.org>, Jamie Lokier <jamie@...reable.org>, Andrew Lutomirski <luto@....edu>, Oleg Nesterov <oleg@...hat.com>, Will Drewry <wad@...omium.org>, linux-kernel@...r.kernel.org, keescook@...omium.org, john.johansen@...onical.com, serge.hallyn@...onical.com, coreyb@...ux.vnet.ibm.com, pmoore@...hat.com, eparis@...hat.com, djm@...drot.org, segoon@...nwall.com, rostedt@...dmis.org, jmorris@...ei.org, scarybeasts@...il.com, avi@...hat.com, penberg@...helsinki.fi, viro@...iv.linux.org.uk, mingo@...e.hu, akpm@...ux-foundation.org, khilman@...com, borislav.petkov@....com, amwang@...hat.com, ak@...ux.intel.com, eric.dumazet@...il.com, gregkh@...e.de, dhowells@...hat.com, daniel.lezcano@...e.fr, linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, olofj@...omium.org, mhalcrow@...gle.com, dlaor@...hat.com, Roland McGrath <mcgrathr@...omium.org> Subject: Re: Compat 32-bit syscall entry from 64-bit task!? [was: Re: [RFC,PATCH 1/2] seccomp_filters: system call filtering using BPF] On Tue, Jan 17, 2012 at 8:22 PM, Indan Zupancic <indan@....nu> wrote: > > Looking at EIP - 2 seems like a secure way to check how we entered the kernel. Secure? No. Not at all. It's actually very easy to fool it. Do something like this: - map the same physical page executably at one address, and writably 4kB above it (use shared memory, and map it twice). - in that page, do this: lea 1f,%edx movl $SYSCALL,%eax movl $-1,4096(%edx) 1: int 0x80 and what happens is that the move that *overwrites* the int 0x80 will not be noticed by the I$ coherency because it's at another address, but by the time you read at $pc-2, you'll get -1, not "int 0x80" Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists