Messages in this thread | | | Date | Sun, 4 May 2003 10:25:26 -0400 | From | Chuck Ebbert <> | Subject | Re: [Announcement] "Exec Shield", new Linux security feature |
| |
> btw, I guess that now, at least when X_workaround==1, exploits will focus > on getting iopl(2) called before they get the actual shellcode called. > In some cases it may be easy to cause a call to iopl (param doesn't matter > as long as its not zero).
I looked at sys_iopl() and it seems to be checking if its param is > 3, so EBX on the stack must be 0x00000003 to set iopl to 3.
The declaration is misleading ("unused"???:)
asmlinkage int sys_iopl(unsigned long unused) { struct pt_regs * regs = (struct pt_regs *) &unused; <== yuck! unsigned int level = regs->ebx; ... if (level > 3) return -EINVAL;
Shouldnt it be like this?
asmlinkage int sys_iopl (struct pt_regs regs) { unsigned int level = regs.ebx; ...
fork, clone, vfork and execve all declare it that way...
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |