 Home |
Products |
Support |
Community |
News |
xen-devel
[Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point
| To: | xen-devel@xxxxxxxxxxxxxxxxxxx |
|---|---|
| Subject: | [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point |
| From: | Chris Wright <chrisw@xxxxxxxx> |
| Date: | Mon, 27 Jun 2005 11:41:57 -0700 |
| Delivery-date: | Mon, 27 Jun 2005 18:40:56 +0000 |
| Envelope-to: | www-data@xxxxxxxxxxxxxxxxxxx |
| List-help: | <mailto:xen-devel-request@lists.xensource.com?subject=help> |
| List-id: | Xen developer discussion <xen-devel.lists.xensource.com> |
| List-post: | <mailto:xen-devel@lists.xensource.com> |
| List-subscribe: | <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe> |
| List-unsubscribe: | <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe> |
| Sender: | xen-devel-bounces@xxxxxxxxxxxxxxxxxxx |
| User-agent: | Mutt/1.5.6i |
Unless I missed something, not bounds checking entries in do_set_gdt is
a security hole.
Signed-off-by: Chris Wright <chrisw@xxxxxxxx>
--- 1.184/xen/arch/x86/mm.c 2005-06-23 02:35:56 -07:00
+++ edited/xen/arch/x86/mm.c 2005-06-27 11:37:30 -07:00
@@ -2442,6 +2442,9 @@ long do_set_gdt(unsigned long *frame_lis
unsigned long frames[16];
long ret;
+ if ( entries > FIRST_RESERVED_GDT_ENTRY )
+ return -EINVAL;
+
if ( copy_from_user(frames, frame_list, nr_pages * sizeof(unsigned long)) )
return -EFAULT;
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | [Xen-devel] Graphical control interface support., Javier Godinez |
|---|---|
| Next by Date: | [Xen-devel] FYI: 2.6.11 XenLinux has issues with x86-64 ia32 emulation compilation on gcc4, Jerone Young |
| Previous by Thread: | [Xen-devel] Graphical control interface support., Javier Godinez |
| Next by Thread: | Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point, Keir Fraser |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
