lkml.org 
[lkml]   [2014]   [Jan]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task)
Adding Borislav.

Boris, do you happen to know of any erratum on AMD E-350 which may be
in play here?

-hpa


On 01/07/2014 11:45 PM, halfdog wrote:
> Update to the issue:
>
> * Although first observed with virtual-8086 mode, the bug is not
> specific to virtual-8086 mode, it can be triggered with normal x86
> userspace code also, even with better reproducibility.
>
> * Ben Hutchings looked at the Debian bug report [1], he failed to
> reproduce on his hardware, so it might be specific to some CPU
> models (currently my AMD E-350 is only machine known to be
> affected).
>
> * When deactivating mmap_min_addr, the NULL-dereferences during
> task-switch is exploitable, works both on native hardware and
> within VirtualBox. See [2] for POC to gain root privileges.
>
> * It seems, that when changing the FPU control word with "fstcw"
> just before exit of the process, then another process could suffer
> when doing __do_switch, probably related to the xsave instruction
> and a x86 processor bug workaround, see "noxsave" switch [3]:
> [BUGS=X86] Disables x86 extended register state save and restore
> using xsave. The kernel will fallback to enabling legacy
> floating-point and sse state.
>
> hd
>
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733551 [2]
> http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/
>
>
[3] https://www.kernel.org/doc/Documentation/kernel-parameters.txt
>
>



\
 
 \ /
  Last update: 2014-01-08 19:01    [W:0.076 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site