oss-sec mailing list archives
CVE request: kernel: x86-64: syscall-audit: 32/64 syscall hole
From: Eugene Teo <eugeneteo () kernel sg>
Date: Mon, 2 Mar 2009 14:46:44 +0800
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with ljmp, and then use the "syscall" instruction to make a 64-bit system call. A 64-bit process make a 32-bit system call with int $0x80. In both these cases, audit_syscall_entry() will use the wrong system call number table and the wrong system call argument registers. This could be used to circumvent a syscall audit configuration that filters based on the syscall numbers or argument details. Credit: Roland McGrath. References: https://bugzilla.redhat.com/show_bug.cgi?id=487990 http://scary.beasts.org/security/CESA-2009-001.html http://lkml.org/lkml/2009/2/27/451 summary http://lkml.org/lkml/2009/2/27/452 syscall-audit http://lkml.org/lkml/2009/2/27/453 seccomp
Current thread:
- CVE request: kernel: x86-64: syscall-audit: 32/64 syscall hole Eugene Teo (Mar 01)