lkml.org 
[lkml]   [1997]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: New pentium bug workaround - please test..
Date
In article <19971119120029.59381@Elf.mj.gts.cz>,
Pavel Machek <pavel@Elf.mj.gts.cz> wrote:
>> Hi!
>
>> The new workaround actually depends on the Intel bug not only forgetting
>> to clear the "lock" state of the instruction, it also forgets to clear the
>> fact that the instruction tries to do a read-modify-write cycle. So it
>> will not only do the IDT access as a locked cycle, it will do it as a
>> locked cycle that requires write permissions..
>
>Is it possible to abuse this bug (or something similar) to actually
>*WRITE* something into IDT? For now, we have DoS attack on pentium,
>writing there would (maybe) give you Ring 0, which means root which
>means hacked machine...

No.

The reason for the lock-up in the first place is really that the IDT
access is so messed up - the pentium is doing it as a locked (and now we
know it's also doing it as a write-permission) access, but because it
then never would write to the IDT to release the lock, the whole machine
stops dead due to the bus being incorrectly locked.

The above isn't really the full story - there are various cache and
TLB-related issues that can hide the lock-up, and that can make it
harder to produce under certain circumstances. But essentially the
problem is that the CPU _thinks_ that it's going to do a locked
read-modify-write cycle, even thought it really is going to only do a
read from the IDT.

So as far as I know, this particular bug will not do anything else than
lock up the machine, and as has been demonstrated it's actually a very
easy bug to work around now that we know about the write protect thing.
The original fix worked, but was conceptually quite complex. The new
and improved ("25% more for the SAME price") workaround is so simple
that the bug really no longer is a problem at all once you know about
it.

(Well, at least under Linux. I suspect it might be much more
problematic on some other systems, and I wouldn't want to be the one
that tries to do it on a Windows95 setup. Although I doubt that MS is
even going to bother about this on Win95).

Linus

\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.062 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site