CVS commit: [netbsd-8] src/sys/arch/amd64/amd64

["Soren Jacobsen" <snj%netbsd.org@localhost>]

Module Name:    src
Committed By:   snj
Date:           Sun Apr  8 06:14:18 UTC 2018

Modified Files:
        src/sys/arch/amd64/amd64 [netbsd-8]: trap.c

Log Message:
Pull up following revision(s) (requested by maxv in ticket #705):
        sys/arch/amd64/amd64/trap.c: 1.113
Mmh. We shouldn't read %cr2 here. %cr2 is initialized by the CPU only
during page faults (T_PAGEFLT), so here we're reading a value that comes
from a previous page fault.
That's a real problem; if you launch an unprivileged process, set up a
signal handler, make it sleep 10 seconds, and trigger a T_ALIGNFLT fault,
you get in si_addr the address of another LWP's page - and perhaps this
can be used to defeat userland ASLR.
This bug has been there since 2003.


To generate a diff of this commit:
cvs rdiff -u -r1.96.4.2 -r1.96.4.3 src/sys/arch/amd64/amd64/trap.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.