lkml.org 
[lkml]   [1997]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: MSR support for x86
    From
    Date
    In <199703010010.QAA25293@cesium.transmeta.com> "H. Peter Anvin" <hpa@transmeta.com> writes:

    >
    > >
    > > I should think you would want it to be crw-r--r--, so that anybody can see
    > > what they are running on.
    >
    > Yes, there need to be something reasonable. I do *not* think it is
    > reasonable for random processes to even read the special registers --
    > on some CPUs that could potentially give away dangerous information.


    Sorry for the late post, but yes, reading things like the number of
    page faults can open subtle security holes.


    I forget the exact details, but I think it was one of the early DEC
    pdp's and the RSTS os that is the prime example of this. The cpu
    would allow users to read page fault counts, so what some clever folks
    did was write a program that forced almost all the pages out. It
    would then call an os function that would verify a password. The OS
    would just compare byte by byte and fail on the first miss match.
    What the clever programmer did was make sure the password would cross
    a page boundary. Then, by looking at the page fault count register, it
    could tell how far into the password the OS had verified before it
    failed. This turns an exponential search space into a linear one.

    Yes, UNIX handles passwords completely differently, and the OS doesn't
    deal with them anyway, but that's not the point. The point is that
    some of this information can be used in surprising ways and I think we
    should be really careful what we allow general users to access.


    -wayne


    --
    Wayne Schlitt can not assert the truth of all statements in this
    article and still be consistent.

    \
     
     \ /
      Last update: 2005-03-22 13:39    [W:0.022 / U:0.744 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site