VirtualBox

Ticket #2301 (closed defect: fixed)

Opened 6 years ago

Last modified 6 years ago

DF variable out of sync with RFLAGS after the SYSCALL instruction

Reported by: jermar Owned by:
Priority: major Component: other
Version: VirtualBox 2.0.2 Keywords: rflags, syscall
Cc: Guest type: other
Host type: other

Description

Masking off the DF flag from the RFLAGS register during the SYSCALL instruction by specifying the DF bit in the SFMASK register doesn't work because the DF variable doesn't get updated. This bug allows a malicious userspace code to damage kernel memory on systems which rely on proper functionality of the SYSCALL instruction and the SFMASK register. Note that the same bug existed in qemu and was fixed in revision 4120:

 http://svn.savannah.gnu.org/viewvc?view=rev&root=qemu&revision=4120

Change History

comment:1 Changed 6 years ago by sandervl73

  • Status changed from new to closed
  • Resolution set to fixed

Fixed. Note that it was quite unlikely to hit this bug in the first place in VirtualBox. Syscall would only in very rare cases be executed in the recompiler.

Thanks for reporting it.

Note: See TracTickets for help on using tickets.

www.oracle.com
ContactPrivacy policyTerms of Use