OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1998: Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras]

Re: [Fwd: NOTE: Solaris 7 gotcha for some ultras]

Solar Designer (solarFALSE.COM)
Fri, 13 Nov 1998 12:01:34 +0300 

Disclaimer: Everything I'm saying below is pure speculation. I'll appreciate
any corrections.

> If they worked around it I'd be more impressed, if they shipped replacement
> CPU's I'd be even more impressed still. The ultrasparc was advertised as
> a 64bit CPU, people did buy them on that basis.

This brings me to a question: what's so special about the 64-bit mode in
the kernel that makes this bug exploitable? It's a user space instruction
that crashes the system, right? We were able to use 64-bit operations on
Solaris 2.5 (well, I did on a 2.5.1) with hand-written assembly. (Top 32
bits of some of the registers were getting lost at context switches.)

So, I see two possibilities: either the bug is in fact still exploitable
in 32-bit mode, too (but possibly not by a C source), or it is related to
one of the following:

1. Full 64-bit virtual addresses.
2. Register windows.
3. Are there any other possibilities?

It is entirely possible that I'm missing something here. It would be nice
if someone from Sun could clarify which property of the 64-bit support in
the kernel makes this bug unexploitable.

Signed,
Solar Designer