From: halfdog <me@halfdog.net>
To: "H. Peter Anvin" <hpa@zytor.com>,
Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
x86@kernel.org, linux-kernel@vger.kernel.org
Subject: Re: Sanitize FPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task)
Date: Fri, 03 Jan 2014 23:07:57 +0000 [thread overview]
Message-ID: <52C742CD.1080500@halfdog.net> (raw)
In-Reply-To: <52C347F0.8070902@zytor.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
H. Peter Anvin wrote:
> On 12/31/2013 11:21 AM, Konrad Rzeszutek Wilk wrote:
>>
>> So, I am wondering if this is related to " x86/fpu: CR0.TS should
>> be set before trap into PV guest's #NM exception handle" which
>> does have a similar pattern - you do enough of the task switches
>> and the FPU is screwed.
>>
>> See
>> http://mid.gmane.org/1383720072-6242-1-git-send-email-gaoyang.zyh@taobao.com
>>
>>
>>
(I thought there was a thread about this on LKML too but I can't
>> find it).
>
> That would be a bug in Xen, so I guess you're surmising a similar
> bug in VirtualBox?
Not sure on that yet, but the whole thing is getting even more
funnier, the longer I can play with it. Here is some more information
from my latest tests:
* Although first observed with virtual-8086 mode, the bug is not
specific to virtual-8086 mode, it can be triggered with normal x86
userspace code also, even with better reproducibility.
* It seems, that when changing the FPU control word with "fstcw" just
before exit of the process, then another process could suffer when
doing __do_switch
* By having two rogue processes writing data to each other via a
socket, time and code-position of OOPS can be influenced.
* When deactivating mmap_min_addr, the NULL-dereferences during
task-switch are exploitable, but I did not get full ring-0 code
execution yet, putting EIP to the NULL-seg seem to have failed,
perhaps wrong RPL? Hoping to fix that during next days.
You can find the new improved test code at [1].
hd
[1]
http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/FpuStateTaskSwitchOops.c
- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlLHQrwACgkQxFmThv7tq+4C+wCfZ0a0LhaJqI7DW78ZFGbnzIyu
6H8AnROrUklhvdbAGV5+7/ELEzPikU7T
=jKjH
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2014-01-03 23:11 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-28 22:02 Sanitize CPU-state when switching from virtual-8086 mode to other task halfdog
2013-12-29 2:37 ` H. Peter Anvin
2013-12-29 20:44 ` halfdog
2013-12-30 1:18 ` H. Peter Anvin
2013-12-30 15:52 ` halfdog
2013-12-31 18:42 ` H. Peter Anvin
2013-12-31 19:21 ` Konrad Rzeszutek Wilk
2013-12-31 22:40 ` H. Peter Anvin
2014-01-03 23:07 ` halfdog [this message]
2014-01-08 7:45 ` Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task) halfdog
2014-01-08 17:42 ` H. Peter Anvin
2014-01-08 19:36 ` Borislav Petkov
2014-01-08 21:28 ` halfdog
2014-01-08 22:39 ` H. Peter Anvin
2014-01-09 22:58 ` Borislav Petkov
2014-01-10 0:42 ` Linus Torvalds
2014-01-10 2:13 ` H. Peter Anvin
2014-01-10 10:06 ` Borislav Petkov
2014-01-10 11:16 ` Linus Torvalds
2014-01-10 11:34 ` Borislav Petkov
2014-01-10 16:11 ` H. Peter Anvin
2014-01-12 3:22 ` [tip:x86/urgent] x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround tip-bot for Linus Torvalds
2014-01-09 22:50 ` Sanitize CPU-state when switching tasks (was sanitize CPU-state when switching from virtual-8086 mode to other task) halfdog
2014-01-09 23:02 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52C742CD.1080500@halfdog.net \
--to=me@halfdog.net \
--cc=hpa@zytor.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.