Messages in this thread | | | Date | Wed, 08 Jan 2014 07:45:50 +0000 | From | halfdog <> | Subject | Re: Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task) |
| |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Update to the issue:
* Although first observed with virtual-8086 mode, the bug is not specific to virtual-8086 mode, it can be triggered with normal x86 userspace code also, even with better reproducibility.
* Ben Hutchings looked at the Debian bug report [1], he failed to reproduce on his hardware, so it might be specific to some CPU models (currently my AMD E-350 is only machine known to be affected).
* When deactivating mmap_min_addr, the NULL-dereferences during task-switch is exploitable, works both on native hardware and within VirtualBox. See [2] for POC to gain root privileges.
* It seems, that when changing the FPU control word with "fstcw" just before exit of the process, then another process could suffer when doing __do_switch, probably related to the xsave instruction and a x86 processor bug workaround, see "noxsave" switch [3]: [BUGS=X86] Disables x86 extended register state save and restore using xsave. The kernel will fallback to enabling legacy floating-point and sse state.
hd
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733551 [2] http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/ [3] https://www.kernel.org/doc/Documentation/kernel-parameters.txt
- -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlLNAjEACgkQxFmThv7tq+44FACfeDHQHK71+7tZawm9Ftjw7Hvp j04AmwY04UwG9clERS3e1HisM2swbo1i =KoQL -----END PGP SIGNATURE-----
| |