WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

To: Chris Wright <chrisw@xxxxxxxx>
Subject: Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point
From: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Date: Mon, 27 Jun 2005 20:21:32 +0100
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 27 Jun 2005 19:24:45 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <20050627184157.GM9157@xxxxxxxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20050627184157.GM9157@xxxxxxxxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

On 27 Jun 2005, at 19:41, Chris Wright wrote:

Unless I missed something, not bounds checking entries in do_set_gdt is
a security hole.

Signed-off-by: Chris Wright <chrisw@xxxxxxxx>

The check happens in set_gdt(). do_set_gdt is just a wrapper with a copy_from_user plus conditional tlb flush.

 -- Keir


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel