Messages in this thread |  | | | Date | Fri, 06 Nov 2009 14:54:28 -0800 | | From | "H. Peter Anvin" <> | | Subject | Re: Using x86 segments against NULL pointer deference exploit |
On 11/06/2009 04:59 AM, castet.matthieu@free.fr wrote: > Hi, > > I am wondering why we can't set the KERNEL_DS data segment to not contain the > first page, ie changing it from R/W flat model to R/W expand down from > 0xffffffff to 4096. > > The modification seems simple : change GDT_ENTRY_KERNEL_DS [1], and some > modification for syscall entry point that doesn't support segment (sysenter). > > The drawback of this it that the kernel can't access anymore data in the first > segment. Is it needed for application like wine or dosemu ? >
Yes, it is. On 32 bits it is possible to switch around segments and do this (in which case you want it to only cover the actual kernel area, and use USER_DS for all user-space references.) This also lets you drop nearly all pointer-range checks, since they are now redundant. However, there is a cost -- it pretty much requires a segment register for USER_DS (this used to be fs once upon a time, hence set_fs) and probably would break Xen and possibly other virtualization solutions.
> PS : why x86_64 segment got access bit set and x86_32 doesn't ?
It is trivially faster to start out with the access bit set -- the hardware will set the accessed bit anyway.
-hpa
|  |