This is the mail archive of the gcc@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: RELEASE BLOCKER: Linux doesn't follow x86/x86-64 ABI wrt direction flag


Olivier Galibert wrote:
On Thu, Mar 06, 2008 at 09:58:41AM -0800, Joe Buck wrote:
If the kernel allows state to leak from one process to another,
for example from a process running as root to a process running as an
ordinary user, it's a bug, with possible security implications.

I don't think that it is relevant in your case. If you have the signal handler in something that does not share the VM with the interrupted thread, you will have a context switch which is supposed to store the direction flag and restore the one from the handling thread. If you share the VM there is no context switch but you have access to the exact same memory with the exact same rights, making the leak irrelevant.

A process can send a signal via kill. IOW, a malicious process can *control when the process would be interrupted* in order to get it into the signal handler with DF=1.


Paolo


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]