Messages in this thread | | | From | (Linus Torvalds) | Subject | Re: New pentium bug workaround - please test.. | Date | 19 Nov 1997 17:32:52 GMT |
| |
In article <19971119120029.59381@Elf.mj.gts.cz>, Pavel Machek <pavel@Elf.mj.gts.cz> wrote: >> Hi! > >> The new workaround actually depends on the Intel bug not only forgetting >> to clear the "lock" state of the instruction, it also forgets to clear the >> fact that the instruction tries to do a read-modify-write cycle. So it >> will not only do the IDT access as a locked cycle, it will do it as a >> locked cycle that requires write permissions.. > >Is it possible to abuse this bug (or something similar) to actually >*WRITE* something into IDT? For now, we have DoS attack on pentium, >writing there would (maybe) give you Ring 0, which means root which >means hacked machine...
No.
The reason for the lock-up in the first place is really that the IDT access is so messed up - the pentium is doing it as a locked (and now we know it's also doing it as a write-permission) access, but because it then never would write to the IDT to release the lock, the whole machine stops dead due to the bus being incorrectly locked.
The above isn't really the full story - there are various cache and TLB-related issues that can hide the lock-up, and that can make it harder to produce under certain circumstances. But essentially the problem is that the CPU _thinks_ that it's going to do a locked read-modify-write cycle, even thought it really is going to only do a read from the IDT.
So as far as I know, this particular bug will not do anything else than lock up the machine, and as has been demonstrated it's actually a very easy bug to work around now that we know about the write protect thing. The original fix worked, but was conceptually quite complex. The new and improved ("25% more for the SAME price") workaround is so simple that the bug really no longer is a problem at all once you know about it.
(Well, at least under Linux. I suspect it might be much more problematic on some other systems, and I wouldn't want to be the one that tries to do it on a Windows95 setup. Although I doubt that MS is even going to bother about this on Win95).
Linus
| |