This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

To: xen-devel@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point
From: Chris Wright <chrisw@xxxxxxxx>
Date: Mon, 27 Jun 2005 11:41:57 -0700
Delivery-date: Mon, 27 Jun 2005 18:40:56 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.6i
Unless I missed something, not bounds checking entries in do_set_gdt is 
a security hole.

Signed-off-by: Chris Wright <chrisw@xxxxxxxx>

--- 1.184/xen/arch/x86/mm.c     2005-06-23 02:35:56 -07:00
+++ edited/xen/arch/x86/mm.c    2005-06-27 11:37:30 -07:00
@@ -2442,6 +2442,9 @@ long do_set_gdt(unsigned long *frame_lis
     unsigned long frames[16];
     long ret;
+    if ( entries > FIRST_RESERVED_GDT_ENTRY )
+        return -EINVAL;
     if ( copy_from_user(frames, frame_list, nr_pages * sizeof(unsigned long)) )
         return -EFAULT;

Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>