• Andy Lutomirski's avatar
    x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common · 90ecd1c5
    Andy Lutomirski authored
    commit 767d035d upstream.
    
    execve used to leak FSBASE and GSBASE on AMD CPUs.  Fix it.
    
    The security impact of this bug is small but not quite zero -- it
    could weaken ASLR when a privileged task execs a less privileged
    program, but only if program changed bitness across the exec, or the
    child binary was highly unusual or actively malicious.  A child
    program that was compromised after the exec would not have access to
    the leaked base.
    Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Borislav Petkov <bpetkov@suse.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Chang Seok <chang.seok.bae@intel.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    90ecd1c5
process_64.c 18.2 KB