This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

To: Chris Wright <chrisw@xxxxxxxx>
Subject: Re: [Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point
From: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Date: Mon, 27 Jun 2005 20:21:32 +0100
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 27 Jun 2005 19:24:45 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <20050627184157.GM9157@xxxxxxxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20050627184157.GM9157@xxxxxxxxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

On 27 Jun 2005, at 19:41, Chris Wright wrote:

Unless I missed something, not bounds checking entries in do_set_gdt is
a security hole.

Signed-off-by: Chris Wright <chrisw@xxxxxxxx>

The check happens in set_gdt(). do_set_gdt is just a wrapper with a copy_from_user plus conditional tlb flush.

 -- Keir

Xen-devel mailing list