RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 01:17:34 +00:00
Code Issues Activity Actions

Kernel: Panic if we're about to switch to a user thread with IOPL!=0

Browse source 
This is a crude protection against IOPL elevation attacks. If for
any reason we find ourselves about to switch to a user mode thread
with IOPL != 0, we'll now simply panic the kernel.

If this happens, it basically means that something tricked the kernel
into incorrectly modifying the IOPL of a thread, so it's no longer
safe to trust the kernel anyway.
This commit is contained in:
Andreas Kling 2020-12-23 14:18:13 +01:00
parent 488a613858
commit c25cf5fb56
2 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Kernel/Arch/i386/CPU.h
View file

@ -44,6 +44,12 @@ class PageDirectory;
class PageTableEntry;
static constexpr u32 safe_eflags_mask = 0xdff;
static constexpr u32 iopl_mask = 3u << 12;
inline u32 get_iopl_from_eflags(u32 eflags)
{
return (eflags & iopl_mask) >> 12;
}
struct [[gnu::packed]] DescriptorTablePointer
{