> btw, I guess that now, at least when X_workaround==1, exploits will focus
> on getting iopl(2) called before they get the actual shellcode called.
> In some cases it may be easy to cause a call to iopl (param doesn't matter
> as long as its not zero).
I looked at sys_iopl() and it seems to be checking if its param is
> 3, so EBX on the stack must be 0x00000003 to set iopl to 3.
The declaration is misleading ("unused"???:)
asmlinkage int sys_iopl(unsigned long unused)
{
struct pt_regs * regs = (struct pt_regs *) &unused; <== yuck!
unsigned int level = regs->ebx;
...
if (level > 3)
return -EINVAL;
Shouldnt it be like this?
asmlinkage int sys_iopl (struct pt_regs regs)
{
unsigned int level = regs.ebx;
...
fork, clone, vfork and execve all declare it that way...
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Wed May 07 2003 - 22:00:19 EST