[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
NetBSD Security Advisory 2010-004: amd64 per-page No-execute (NX) bit disabled
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2010-004
Topic: amd64 per-page No-execute (NX) bit disabled
Version: NetBSD-current: affected prior to April 19, 2010
NetBSD 5.0.*: affected
NetBSD 5.0: affected
NetBSD 4.0.*: not affected
NetBSD 4.0: not affected
Severity: Possible execution of arbitrary code without memory protection
Fixed: NetBSD-current: April 19, 2010
NetBSD-5-0 branch: April 22, 2010
NetBSD-5 branch: April 22, 2010
Please note that NetBSD releases prior to 4.0 are no longer supported.
It is recommended that all users upgrade to a supported release.
An issue in the x86 CPU features detection code disables the use of the
per-page NX bit under amd64, making it impossible to mark certain pages
of memory as not being executable.
The NX bit from AMD (equivalent to the XD bit for Intel) indicates if
the processor supports the NX bit feature (execution right enforced
on a per-page basis). This bit is obtained through the "extended
feature flags" cpuid instruction, inside %edx.
All amd64 code, especially pmap(9), checks for this feature through the
cpu_feature variable. It is set in src/sys/arch/amd64/amd64/locore.S:
- - first with the "feature flags" cpuid instruction (cpuid + %eax = 1),
- - then ORed with the "extended feature flags" cpuid (cpuid + %eax =
When entering init_x86_64(), the value is erased by the cpu_probe() call.
beginning of cpu_probe():
- - cpuid instruction (%eax == 1) flags gets stored in
- - cpuid instruction (%eax == 0x8000_0001) flags get stored in
end of cpu_probe():
- - cpu_feature_flags is then set (or ANDed) with
cpu_info_primary->ci_feature_flags, losing the CPUID_NOX bit in the process
(which is expected to be found in ci_feature3_flags)
Following this, the MSR enabling the NX feature (EFER_NXE) is never set. As
a consequence, the NX bit support is deactivated, and no exception will
be raised even if an instruction is fetched from a page marked as not being
Solutions and Workarounds
No workaround to the problem is currently known. Users are advised to
restrict access to the system to trusted users only, both locally and
When considered individually, this issue is not directly exploitable.
Only programs depending on execution's right enforcement in memory
may be affected, as well as badly written ones where stack, heap
and/or data sections could be used to inject and execute a
specifically crafted payload.
The following instructions describe how to upgrade your kernel
binaries by updating your source tree and rebuilding and
installing a new version of the kernel.
For all NetBSD versions, you need to obtain fixed kernel sources,
rebuild and install the new kernel, and reboot the system.
The fixed source may be obtained from the NetBSD CVS repository.
The following instructions briefly summarise how to upgrade your
kernel. In these instructions, replace:
ARCH with your architecture (from uname -m), and
KERNCONF with the name of your kernel configuration file.
To update from CVS, re-build, and re-install the kernel:
# cd src
# cvs update -d -P sys/arch/x86
# cvs update -d -P sys/arch/amd64
# ./build.sh kernel=KERNCONF
# mv /netbsd /netbsd.old
# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
# shutdown -r now
For more information on how to do this, see:
Jeremy Morse and Jean-Yves Migeon for independently finding and reporting
the issue, and Jean-Yves Migeon for providing a patch.
2010-04-26 Initial release
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/.
Copyright 2010, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
$NetBSD: NetBSD-SA2010-004.txt,v 1.1 2010/04/25 21:37:39 tonnerre Exp $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (NetBSD)
-----END PGP SIGNATURE-----
Main Index |
Thread Index |