Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937044Ab3DJJlo (ORCPT ); Wed, 10 Apr 2013 05:41:44 -0400 Received: from mail-ee0-f54.google.com ([74.125.83.54]:57615 "EHLO mail-ee0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S937029Ab3DJJlk (ORCPT ); Wed, 10 Apr 2013 05:41:40 -0400 Date: Wed, 10 Apr 2013 11:41:35 +0200 From: Ingo Molnar To: Kees Cook Cc: "H. Peter Anvin" , "kernel-hardening@lists.openwall.com" , Ingo Molnar , LKML , "x86@kernel.org" , Konrad Rzeszutek Wilk , Jeremy Fitzhardinge , Marcelo Tosatti , Alex Shi , Borislav Petkov , Alexander Duyck , Frederic Weisbecker , Steven Rostedt , "Paul E. McKenney" , "xen-devel@lists.xensource.com" , "virtualization@lists.linux-foundation.org" , Dan Rosenberg , Julien Tinnes , Will Drewry , Eric Northup Subject: Re: [kernel-hardening] Re: [PATCH] x86: make IDT read-only Message-ID: <20130410094135.GD24443@gmail.com> References: <20130408224328.GA17641@www.outflux.net> <51634935.9010905@zytor.com> <51645D6F.7070705@zytor.com> <51646054.3090509@zytor.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 914 Lines: 24 * Kees Cook wrote: > > That's the area in which we just map 1:1 to memory. Anything allocated with > > e.g. kmalloc() ends up with those addresses. > > Ah-ha! Yes, I see now when comparing the debug/kernel_page_tables reports. It's > just the High Kernel Mapping that we care about. Addresses outside that range > are less of a leak. Excellent, then GDT may not be a problem. Whew. It's still an infoleak to worry about: any function pointers nearby matter, and the x86 GDT is obviously full of useful and highly privilege-relevant function pointers ... I have no objections against read-only mapping the GDT as well. Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/