Re: [CHECKER] pcmcia user-pointer dereference

[daw@mozart.cs.berkeley.edu (David Wagner)]

Hollis Blanchard  wrote:
>I contacted David Hinds about this; the behavior is by design. User 
>space passes in a pointer to a kernel data structure, and the kernel 
>verifies it by checking a magic number in that structure.

As you and others point out, this isn't safe, in general.  What if an
attacker can get the magic number at the required offset from interesting
memory location in kernel space?  This seems like a plausible assumption.
Then the attacker can read secret kernel memory, which is bad.

This sounds scary.  I don't know whether there are any exploitable
attacks here, but based on what you said, it seems strange to take this
kind of risk.

Sounds to me like it should be treated as a security hole.  Good catch,
Junfeng et al!