linux-kernel - Re: PLEASE REVERT URGENTLY: Re: [PATCH v5 2/3] x86/boot: add acpi rsdp address to setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <59ca1053-9176-f1db-6e6c-96b47aaaa09d@zytor.com>
Date:   Fri, 9 Nov 2018 23:16:02 -0800
From:   "H. Peter Anvin" <hpa@...or.com>
To:     Juergen Gross <jgross@...e.com>, linux-kernel@...r.kernel.org,
        xen-devel@...ts.xenproject.org, x86@...nel.org,
        linux-doc@...r.kernel.org
Cc:     tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, corbet@....net,
        boris.ostrovsky@...cle.com
Subject: Re: PLEASE REVERT URGENTLY: Re: [PATCH v5 2/3] x86/boot: add acpi
 rsdp address to setup_header

On 11/9/18 11:02 PM, Juergen Gross wrote:
>>
>> Yes. We know that and it is resolved by:
>>
>> a) the length field in setup_header;
>> b) the "sentinel" field which catches legacy non-compliant bootloaders.
> 
> Doesn't help for boot loaders reading struct setup_header from the
> kernel image and then writing e.g. 512 bytes back to the setup_header
> location. The sentinel is cleared and the length field just isn't
> taken into account. And this is what happened.
> 

This is insane?! How do they manage to do this... it's not like  this isn't
written out in plain English to follow. I am, once again, utterly and
genuinely baffled about how many ways Grub can do things wrong.

So we should probably add a terminal sentinel field at offset 0x281, which is
one byte past the longest possible setup_header structure; in fact, we may
just want to explicitly pad setup_header with zeroes to its final size, if
nothing else to make it explicit how little space is actually left in there.

It would be enormously helpful if you could find out any more details about
exactly what they are doing to break things.

Many thanks,

	-hpa