[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] CVE request: kernel: x86-64: seccomp: 32/64 syscall hole
From: Eugene Teo <eugeneteo () kernel ! sg>
Date: 2009-03-02 6:44:05
Message-ID: 28fa9c5e0903012244m557ec963w358917b1b66a9031 () mail ! gmail ! com
[Download RAW message or body]
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call. A 64-bit process make a 32-bit system call with int $0x80.
In both these cases under CONFIG_SECCOMP=y, secure_computing() will
use the wrong system call number table. The fix is simple: test
TS_COMPAT instead of TIF_IA32.
Credit: Chris Evans.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=487255
http://scary.beasts.org/security/CESA-2009-001.html
http://scary.beasts.org/security/CESA-2009-004.html
http://lkml.org/lkml/2009/2/27/451 summary
http://lkml.org/lkml/2009/2/27/452 syscall-audit
http://lkml.org/lkml/2009/2/27/453 seccomp
http://lkml.org/lkml/2009/2/28/23 seccomp follow-ups
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic