[Xen-devel] [PATCH] proper bounds check in do_set_gdt entry point

[Chris Wright <chrisw@xxxxxxxx>]

Unless I missed something, not bounds checking entries in do_set_gdt is 
a security hole.

Signed-off-by: Chris Wright <chrisw@xxxxxxxx>

--- 1.184/xen/arch/x86/mm.c     2005-06-23 02:35:56 -07:00
+++ edited/xen/arch/x86/mm.c    2005-06-27 11:37:30 -07:00
@@ -2442,6 +2442,9 @@ long do_set_gdt(unsigned long *frame_lis
     unsigned long frames[16];
     long ret;
 
+    if ( entries > FIRST_RESERVED_GDT_ENTRY )
+        return -EINVAL;
+
     if ( copy_from_user(frames, frame_list, nr_pages * sizeof(unsigned long)) )
         return -EFAULT;
 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel