Fix int 0x80 hole in 2.4 x86-64 linux kernels

PATCH In review Andi Kleen 2 participants 4 messages Dec 22, 2004

Share & tools

Andi Kleen

author

2004-12-22 17:58 UTC #0 lore raw

PATCH 1/1 Fix int 0x80 hole in 2.4 x86-64 linux kernels

Petr Vandrovec discovered an exploitable root hole on all 2.4 x86-64 kernels. The problem occurs because the eax register on the 32bit int 0x80 syscall handler is not properly 64bit zero extended, which can be used to overflow the system call table.

The problem only occurs on 2.4 x86-64 kernels, 2.6 doesn't have this hole because some unrelated changes in 2.5 fixed it as a side effect.

Marcelo should be releasing a new pre* kernel with this fix shortly, there should be also update kernel from the various linux distributions.

It is recommended that everybody who runs a 2.4 x86-64 kernel with shell user access updates to a kernel which has this patch applied.

Patch is for 2.4.29pre2, but should apply to pretty much any 2.4.x x86-64 kernel.

-Andi

arch/x86_64/ia32/ia32entry.S renamed from arch/x86_64/ia32/ia32entry.S-o +1 -0

diff -u linux-2.4.29pre2/arch/x86_64/ia32/ia32entry.S-o linux-2.4.29pre2/arch/x86_64/ia32/ia32entry.S
@@ -52,6 +52,7 @@
 ENTRY(ia32_syscall)
 	swapgs	
 	sti
+	movl %eax,%eax	
 	pushq %rax
 	cld
 	SAVE_ARGS

Willy Tarreau

2004-12-22 18:21 UTC #1 lore raw

Hi Andi,

On Wed, Dec 22, 2004 at 06:58:18PM +0100, Andi Kleen wrote:
(...)

arch/x86_64/ia32/ia32entry.S line 56

Quoted 3 lines

arch/x86_64/ia32/ia32entry.S renamed from arch/x86_64/ia32/ia32entry.S-o +1 -0
 	sti
+	movl %eax,%eax	
 	pushq %rax

Although I don't know about x86_64 assembly, I know x86 and I wonder how this patch would do anything. I would personnaly have written something more like :

+ movzl %eax,%rax

Once again, I may be wrong, but I really don't understand at all then. Could you please either confirm or detail a bit more ?

thanks in advance,
Willy

Andi Kleen

author

2004-12-22 18:24 UTC #2 lore raw

Quoted 11 lines · Willy Tarreau

Hi Andi,
On Wed, Dec 22, 2004 at 06:58:18PM +0100, Andi Kleen wrote:
(...)
arch/x86_64/ia32/ia32entry.S line 56
Quoted 3 lines
arch/x86_64/ia32/ia32entry.S renamed from arch/x86_64/ia32/ia32entry.S-o +1 -0
 	sti
+	movl %eax,%eax	
 	pushq %rax
Although I don't know about x86_64 assembly, I know x86 and I wonder how this patch would do anything. I would personnaly have written something more like :

An 32bit write in long mode clears the upper 32bits of the register. See the x86-64 architecture manuals for more details.

-Andi

Willy Tarreau

2004-12-22 18:47 UTC #3 lore raw

Quoted 10 lines · Andi Kleen

Quoted 8 lines
(...)
arch/x86_64/ia32/ia32entry.S line 56
Quoted 3 lines
arch/x86_64/ia32/ia32entry.S renamed from arch/x86_64/ia32/ia32entry.S-o +1 -0
 	sti
+	movl %eax,%eax	
 	pushq %rax
Although I don't know about x86_64 assembly, I know x86 and I wonder how this patch would do anything. I would personnaly have written something more like :
An 32bit write in long mode clears the upper 32bits of the register.

Ok, thanks for this quick precision, it wasn't obvious at first glance.

Quoted 1 line

See the x86-64 architecture manuals for more details.

Oh, I did a long time ago, when the athlon64 was only an emulator which ran under linux, but I forgot all the details since then.

Thanks,
Willy