This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

To: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Subject: Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point
From: Chris Wright <chrisw@xxxxxxxx>
Date: Mon, 27 Jun 2005 13:00:53 -0700
Cc: Chris Wright <chrisw@xxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 27 Jun 2005 20:00:12 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <97f95b5ed2852e5d2385e36c03a37e64@xxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20050627184157.GM9157@xxxxxxxxxxxxxxxxxxx> <97f95b5ed2852e5d2385e36c03a37e64@xxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.6i
* Keir Fraser (Keir.Fraser@xxxxxxxxxxxx) wrote:
> On 27 Jun 2005, at 19:41, Chris Wright wrote:
> >Unless I missed something, not bounds checking entries in do_set_gdt is
> >a security hole.
> >
> >Signed-off-by: Chris Wright <chrisw@xxxxxxxx>
> The check happens in set_gdt(). do_set_gdt is just a wrapper with a 
> copy_from_user plus conditional tlb flush.

I know, but copy_from_user has no sane limits.  This is stack smash.

Xen-devel mailing list