lkml.org 
[lkml]   [2003]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [BROKEN PATCH] syscalls leak data via registers?
    On Thu, 7 Aug 2003, Jeremy Fitzhardinge wrote:

    > On Thu, 2003-08-07 at 03:30, Pavel Machek wrote:
    > > I believe userspace depends on registers to be preserved over system
    > > call, except for eax.
    >
    > That's what I was wondering. Does it? Is that a documented part of the
    > syscall interface?
    >
    > > So what you found is not only security problem,
    > > but also crasher bug.
    >
    > In these sense that it crashes userspace?
    >
    > J
    >

    The kernel interface preserves the registers that GCC needs
    preserved, i.e., index registers such as EBX, ESI, and EDI.
    It may not preserve registers that convey information for
    the call unless they are index registers. For instance,
    a system call that takes two parameters has those parameters
    put into EBX and ECX. Register EAX always contains the
    function number. In the case described, only EBX is
    guaranteed to be preserved, this because it's an index
    register.

    Typically parameters are passed as:

    No parameters EAX
    1 parameter EAX EBX
    2 parameters EAX EBX ECX
    3 parameters EAX EBX ECX EDX
    4 parameters EAX EBX ECX EDX ESI
    5 parameters EAX EBX ECX EDX ESI EDI
    6 parameters EAX EBX ECX EDX ESI EDI EBP

    Upon return only the index registers plus segments and stack
    will be preserved. The other registers can contain anything.
    However, this is hardly an 'information' leak. Even if the
    address of something in the kernel was returned, it can't
    be accessed, and the 'information' is all about the methods
    used to perform a function upon behalf of the caller, not
    some other task. In other words, if you are reading from
    a file, and some register contains 42, you only know that
    that value was used somewhere while helping you get the
    file data. It is never some data from somebody else's file.
    To get to somebody else's data requires a context switch and
    all registers and restored are saved across a context switch.
    In Unix, the kernel performs functions on behalf of the caller,
    within the context of the caller, so register information
    is not an information leak.

    But, there is the possibility of having data left in memory
    by another task, accessed by the current task. These possibilities
    are constantly reviewed and fixed when found.

    Cheers,
    Dick Johnson
    Penguin : Linux version 2.4.20 on an i686 machine (797.90 BogoMips).
    Note 96.31% of all statistics are fiction.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:47    [W:4.802 / U:0.184 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site