OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1997: Re: WARNING: Linux Intel Pentium Bug

Re: WARNING: Linux Intel Pentium Bug

Tim Newsham (newshamLAVA.NET)
Fri, 7 Nov 1997 12:49:41 -1000 

> Ran it on my P166, kaboom, ran it on my new P166MMX, kaboom. I guess that
> would be a yes. This is kind of scary, is there any possibility of a
> kernel patch that can take care of this?

There are checks you could do from the kernel but they would not
be able to reliably detect an arbitrary program which would
cause this instruction to run.  In other words, if I saw your
patch, i could easily write a program that gets around it.

quick ideas that have been discussed with others:

   - check for the instruction
     problem: i can synthesize the instruction at run time

   - check to see if the code synthesizes and runs the instruction
     problem: you cant do this statically (its undecideable)
     and to do it dynamically you'd have to interpret every
     instruction you executed (too costly)

   - dont allow code to run out of stack
     problem: i can synthesize it elsewhere

   - dont allow code to run out of anything but the read-only
     text segment.
     problem: i can change the protection on the text segment

   - force text segment to always be read-only

forcing code to run out of text could cause some existing programs
to break.

> -seifried

                                           Tim N.