Re: FW: i386 Linux kernel DoS

From: Krzysiek Taraszka (dzimi@pld.org.pl)
Date: Sat Nov 16 2002 - 14:33:08 EST


On 13 Nov 2002, Alan Cox wrote:

> On Tue, 2002-11-12 at 23:31, Christoph Hellwig wrote:
> > On Tue, Nov 12, 2002 at 02:28:55PM -0900, Leif Sawyer wrote:
> > > This was posted on bugtraq today...
> >
> > A real segfaulting program? wow :)
>
> Looks like the TF handling bug which was fixed a while ago

It wasn't fixed for 2.2.22. 2.2 has got only syscall7, so fix should be
trivial, isn't ?
Should be look like:

diff -urN linux.orig/arch/i386/kernel/entry.S
linux/arch/i386/kernel/entry.S
--- linux.orig/arch/i386/kernel/entry.S Tue May 21 01:32:34 2002
+++ linux/arch/i386/kernel/entry.S Thu Nov 14 21:39:36 2002
@@ -63,7 +63,9 @@
 OLDSS = 0x38

 CF_MASK = 0x00000001
+TF_MASK = 0x00000100
 IF_MASK = 0x00000200
+DF_MASK = 0x00000400
 NT_MASK = 0x00004000
 VM_MASK = 0x00020000

@@ -139,6 +141,9 @@
        movl CS(%esp),%edx # this is eip..
        movl EFLAGS(%esp),%ecx # and this is cs..
        movl %eax,EFLAGS(%esp) #
+ andl $~(NT_MASK|TF_MASK|DF_MASK), %eax
+ pushl %eax
+ popfl
        movl %edx,EIP(%esp) # Now we move them to their "normal" places
        movl %ecx,CS(%esp) #
        movl %esp,%ebx

or I missing somethink ?

Krzysiek Taraszka (dzimi@pld.org.pl)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Nov 23 2002 - 22:00:17 EST