lkml.org 
[lkml]   [2003]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Possible bug in arch/i386/kernel/process.c for reloading of debug registers (DRx)?
Andi Kleen wrote:
> > What if DRx contains sensitive data? ...Its probably pretty
> > unlikely. Still it allows for example easy communication between tasks
> > that should not be able to communicate.
>
> The user never sees the stale value, it is eaten by the kernel's do_debug
> handler.

DR6 isn't cleared. Here is a nice security exploit for you:

- Task A sets DR0 and DR7 to enable a watchpoint (or breakpoint).
- It also clears DR6.
- Task A wakes up task B, which has DR7 clear.
- Task A then communicates with "sshd" or some other sensitive task.

- Because of lazy DR7 clearing, sshd inherits the watchpoints.
- If sshd reads the memory address mentioned in DR0, it will
call do_debug in the kernel, which clears DR7 and continues.
- However, DR6 bit B0 is now set.

- Eventually task B is scheduled. It inherits the value of DR6
from sshd, and therefore knows if sshd read from a particular
memory location.

- Task A and task B cooperate to analyse what values sshd is
examining in its lookup tables, and therefore retrieve the
server key or something. (Hand waving at this point).

-- Jamie
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:33    [W:0.044 / U:0.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site