Messages in this thread | | | Date | Thu, 08 Oct 2009 11:58:22 -0700 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH] x86-64: don't leak kernel register values to 32-bit processes |
| |
On 10/07/2009 02:44 AM, Pavel Machek wrote: > Hi! > >> While 32-bit processes can't directly access R8...R15, they can gain >> access to these registers by temporarily switching themselves into >> 64-bit mode. Therefore, registers not preserved anyway by called C >> functions (i.e. R8...R11) must be cleared prior to returning to user >> mode. > > How can userspace "temporarily switch itself" to 64bit mode? > > Such ability would lead to very interesting behaviour on 32-bit > kernel, I'd say...
You can only do so with a 64-bit kernel, but on a 64-bit kernel you can do it by executing a far jump to segment USER_CS (0x33).
-hpa
| |