From: "H. Peter Anvin" <hpa@zytor.com>
To: castet.matthieu@free.fr
Cc: linux-kernel@vger.kernel.org
Subject: Re: Using x86 segments against NULL pointer deference exploit
Date: Fri, 06 Nov 2009 14:54:28 -0800 [thread overview]
Message-ID: <4AF4A924.5080609@zytor.com> (raw)
In-Reply-To: <1257512389.4af41dc504e1b@imp.free.fr>
On 11/06/2009 04:59 AM, castet.matthieu@free.fr wrote:
> Hi,
>
> I am wondering why we can't set the KERNEL_DS data segment to not contain the
> first page, ie changing it from R/W flat model to R/W expand down from
> 0xffffffff to 4096.
>
> The modification seems simple : change GDT_ENTRY_KERNEL_DS [1], and some
> modification for syscall entry point that doesn't support segment (sysenter).
>
> The drawback of this it that the kernel can't access anymore data in the first
> segment. Is it needed for application like wine or dosemu ?
>
Yes, it is. On 32 bits it is possible to switch around segments and do
this (in which case you want it to only cover the actual kernel area,
and use USER_DS for all user-space references.) This also lets you drop
nearly all pointer-range checks, since they are now redundant. However,
there is a cost -- it pretty much requires a segment register for
USER_DS (this used to be fs once upon a time, hence set_fs) and probably
would break Xen and possibly other virtualization solutions.
> PS : why x86_64 segment got access bit set and x86_32 doesn't ?
It is trivially faster to start out with the access bit set -- the
hardware will set the accessed bit anyway.
-hpa
next prev parent reply other threads:[~2009-11-06 22:54 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-11-06 12:59 Using x86 segments against NULL pointer deference exploit castet.matthieu
2009-11-06 13:13 ` Alan Cox
2009-11-06 20:35 ` matthieu castet
2009-11-09 6:30 ` H. Peter Anvin
2009-11-06 20:18 ` Andi Kleen
2009-11-08 14:38 ` matthieu castet
2009-11-08 19:41 ` Andi Kleen
2009-11-06 20:58 ` Jiri Kosina
2009-11-06 22:54 ` H. Peter Anvin [this message]
2009-11-07 10:20 ` Jiri Kosina
[not found] <dDwJH-3PE-7@gated-at.bofh.it>
2009-11-10 16:46 ` Markku Savela
2009-11-11 14:11 ` Jiri Kosina
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4AF4A924.5080609@zytor.com \
--to=hpa@zytor.com \
--cc=castet.matthieu@free.fr \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.