WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

To: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Subject: Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point
From: Chris Wright <chrisw@xxxxxxxx>
Date: Mon, 27 Jun 2005 13:00:53 -0700
Cc: Chris Wright <chrisw@xxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 27 Jun 2005 20:00:12 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <97f95b5ed2852e5d2385e36c03a37e64@xxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20050627184157.GM9157@xxxxxxxxxxxxxxxxxxx> <97f95b5ed2852e5d2385e36c03a37e64@xxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.6i
* Keir Fraser (Keir.Fraser@xxxxxxxxxxxx) wrote:
> 
> On 27 Jun 2005, at 19:41, Chris Wright wrote:
> 
> >Unless I missed something, not bounds checking entries in do_set_gdt is
> >a security hole.
> >
> >Signed-off-by: Chris Wright <chrisw@xxxxxxxx>
> 
> The check happens in set_gdt(). do_set_gdt is just a wrapper with a 
> copy_from_user plus conditional tlb flush.

I know, but copy_from_user has no sane limits.  This is stack smash.
-chris

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel