linux-kernel - Re: [PATCH v3 1/7] x86/ldt: refresh %fs and %gs in refresh_ldt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 Jun 2018 07:24:56 -0700
From:   Andy Lutomirski <luto@...nel.org>
To:     "H. Peter Anvin" <h.peter.anvin@...el.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        "H. Peter Anvin" <hpa@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andrew Lutomirski <luto@...nel.org>,
        "Bae, Chang Seok" <chang.seok.bae@...el.com>,
        "Metzger, Markus T" <markus.t.metzger@...el.com>
Subject: Re: [PATCH v3 1/7] x86/ldt: refresh %fs and %gs in refresh_ldt_segments()

On Thu, Jun 21, 2018 at 2:18 PM H. Peter Anvin, Intel
<h.peter.anvin@...el.com> wrote:
>
> From: "H. Peter Anvin" <hpa@...ux.intel.com>
>
> It is not only %ds and %es which contain cached user descriptor
> information, %fs and %gs do as well.
>
> To make sure we don't do something stupid that will affect processes
> which wouldn't want this requalification, be more restrictive about
> which selector numbers will be requalified: they need to be LDT
> selectors (which by definition are never null), have an RPL of 3
> (always the case in user space unless null), and match the updated
> descriptor.

That RPL3 part is false.  The following program does:

#include <stdio.h>

int main()
{
    unsigned short sel;
    asm volatile ("mov %%ss, %0" : "=rm" (sel));
    sel &= ~3;
    printf("Will write 0x%hx to GS\n", sel);
    asm volatile ("mov %0, %%gs" :: "rm" (sel & ~3));
    asm volatile ("mov %%gs, %0" : "=rm" (sel));
    printf("GS = 0x%hx\n", sel);
    return 0;
}

prints:

Will write 0x28 to GS
GS = 0x28

The x86 architecture is *insane*.

Other than that, this patch seems generally sensible.  But my
objection that it's incorrect with FSGSBASE enabled for %fs and %gs
still applies.