linux-kernel - Re: [PATCH] x86/acpi: check rsdp address received via bootparams to be valid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <432c21ab-24d8-1e70-a471-ad8a14357d4e@suse.com>
Date:   Tue, 16 Jan 2018 16:56:21 +0100
From:   Juergen Gross <jgross@...e.com>
To:     Ingo Molnar <mingo@...nel.org>
Cc:     linux-kernel@...r.kernel.org, linux-acpi@...r.kernel.org,
        x86@...nel.org, lenb@...nel.org, rafael.j.wysocki@...el.com,
        hpa@...or.com, tglx@...utronix.de, mingo@...hat.com
Subject: Re: [PATCH] x86/acpi: check rsdp address received via bootparams to
 be valid

On 16/01/18 16:46, Ingo Molnar wrote:
> 
> * Juergen Gross <jgross@...e.com> wrote:
> 
>> There seem to exist several grub2 versions trashing
>> boot_params.hdr.acpi_rsdp_addr.
>>
>> So don't just believe this address to be valid, but verify it pointing
>> to a valid RSDP table.
> 
> Exactly what kind of values do those Grub2 versions put into that field? Pointer 
> to something, or random noise?

Looks like random noise. On Mike's system it was 0x000000000151.

> Also, what exactly does 'validation' mean, how robustly does it filter out of spec 
> uses of the boot protocol?

It validates the RSDP has the correct 8 byte eye catcher in it and
the checksum of the structure is correct. Searching the RSDP by
scanning memory is using the same checks, so I guess this ought to
be okay. Odds are about 1 : 2^80 for false positives.


Juergen