Re: Using x86 segments against NULL pointer deference exploit

From: matthieu castet
Date: Fri Nov 06 2009 - 15:36:05 EST

Hi Alan,

Alan Cox wrote:
On Fri, 06 Nov 2009 13:59:49 +0100
castet.matthieu@xxxxxxx wrote:


I am wondering why we can't set the KERNEL_DS data segment to not contain the
first page, ie changing it from R/W flat model to R/W expand down from
0xffffffff to 4096.

For one it is enormously expensive because the moment you have segment
limits all sorts of stuff goes slower.
We can always imagine a lazy mechanism that will enable segment limit when page0 is mapped.
That will only slow down the machine when wine & co are running.

and for APM and so on.
APM clears all segment before calling bios (APM_ZERO_SEGS is defined for detecting buggy bios) and pnpbios seems to have their own segment (GDT_ENTRY_PNPBIOS) There is also GDT_ENTRY_APMBIOS_BASE,
but that seems unused.

You also do sometimes need low 4K
access for wine/dosemu etc as you guess -
That's a bigger problem. If there not many access we can imagine fix it with trap/single step.

64bit you don't have a lot of those features ayway.

May be the sane way should be to forbid mapping page 0, and make run application needing page 0 in a
emulator. After all it is for special case [1] :
- Win16 binary for wine
- upstream version of dosemu and qemu have workaround

But some distro still set mmap_min_addr to 0 (ubuntu+wine, ...) :(


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at