[lkml]   [2018]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v2 1/3] x86/entry: Clear extra registers beyond syscall arguments for 64bit kernels

* Andi Kleen <> wrote:

> > - There's various conditional pieces of entry code that run before any
> > RBP-clobbering C function is called. While none of them has an exploitable
> > Spectre 'gadget' at the moment, we'd have to consider this for every future
> > change.
> The Frame Pointer is always set up in assembler too, just in another macro.

As I replied to Andy, that's not universally true: there are code paths where RBP
is not set before calling C code or going into the more complex parts of the
kernel entry code.

This RBP value leak in fact demonstrates the validity of my robustness argument:

> > I.e. we cannot universally rely on RBP being sanitized. In _practice_ it
> > will be sanitized, but we don't know for sure without expending quite some
> > effort to think through all the cases.



 \ /
  Last update: 2018-02-06 08:20    [W:0.061 / U:0.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site