[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE request: kernel: x86-64: syscall-audit: 32/64 syscall hole
From:       Eugene Teo <eugeneteo () kernel ! sg>
Date:       2009-03-02 6:46:44
Message-ID: 28fa9c5e0903012246g8ce28fbqbcf7fbae35ace542 () mail ! gmail ! com
[Download RAW message or body]

On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call.  A 64-bit process make a 32-bit system call with int $0x80.

In both these cases, audit_syscall_entry() will use the wrong system
call number table and the wrong system call argument registers.  This
could be used to circumvent a syscall audit configuration that filters
based on the syscall numbers or argument details.

Credit: Roland McGrath.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=487990
http://scary.beasts.org/security/CESA-2009-001.html
http://lkml.org/lkml/2009/2/27/451 summary
http://lkml.org/lkml/2009/2/27/452 syscall-audit
http://lkml.org/lkml/2009/2/27/453 seccomp
[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic