Bugtraq mailing list archives
Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras]
From: solar () FALSE COM (Solar Designer)
Date: Fri, 13 Nov 1998 12:01:34 +0300
Disclaimer: Everything I'm saying below is pure speculation. I'll appreciate any corrections.
If they worked around it I'd be more impressed, if they shipped replacement CPU's I'd be even more impressed still. The ultrasparc was advertised as a 64bit CPU, people did buy them on that basis.
This brings me to a question: what's so special about the 64-bit mode in the kernel that makes this bug exploitable? It's a user space instruction that crashes the system, right? We were able to use 64-bit operations on Solaris 2.5 (well, I did on a 2.5.1) with hand-written assembly. (Top 32 bits of some of the registers were getting lost at context switches.) So, I see two possibilities: either the bug is in fact still exploitable in 32-bit mode, too (but possibly not by a C source), or it is related to one of the following: 1. Full 64-bit virtual addresses. 2. Register windows. 3. Are there any other possibilities? It is entirely possible that I'm missing something here. It would be nice if someone from Sun could clarify which property of the 64-bit support in the kernel makes this bug unexploitable. Signed, Solar Designer
Current thread:
- Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras] Paul Murphy (Nov 11)
- Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras] Alan Cox (Nov 11)
- Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras] Solar Designer (Nov 13)
- Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras] Tabor J. Wells (Nov 13)
- Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras] Casper Dik (Nov 14)
- Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras] Alan Cox (Nov 11)