However, I'm just very curious about why x86 processor leaks kernel data structures by some unprivileged instructions. Is this a bad CPU design?
Here is an example.
x86 IDTR register holds the base memory address for the Interrupt Descriptor Table entries (vector 0 through 255). As long as we gets its address, we can calculate and get all the ISR memory addresses of all exceptions/interrupts in a system.
But an user program can simply get the IDTR address by executing SIDT instruction.
See these two real-world example exploits below, if SIDT instruction in x86 were not allowed to execute in user mode, then one more roadblock would be placed to mitigate such an attack.
1) Linux Kernel ptrace/sysret - Local Privilege Escalation
http://www.exploit-db.com/exploits/34134/
2) Ubuntu 12.04.0-2LTS x64 - perf_swevent_init Kernel Local Root Exploit
http://www.exploit-db.com/exploits/33589/
So the questions:
The similar instructions are SGDT (retrieving Global Descriptor Table Register), and even seldom used instructions like STR, SLDT, SMSW.
Anybody (Intel processor architect or application software developer) can tell me the reason of that?
Update:
Why SIDT/SGDT instructions are allowed to execute in user mode (x86/Intel)?
So the questions:
- Why does Intel/x86 allow such an instruction to be executed by unprivileged program/task in user mode?
- Is there any legitimate application in user mode that must have to use this instruction to get kernel structure address?
The similar instructions are SGDT (retrieving Global Descriptor Table Register), and even seldom used instructions like STR, SLDT, SMSW.
Anybody (Intel processor architect or application software developer) can tell me the reason of that?
Update:
Why SIDT/SGDT instructions are allowed to execute in user mode (x86/Intel)?
UMIP = User-Mode Instruction Prevention (bit 11 of CR4)— When set, the following instructions cannot beexecuted if CPL > 0: SGDT, SIDT, SLDT, SMSW, and STR. An attempt at such execution causes a general-protection exception (#GP).
ReplyDeleteCR4 register has UMIP bit that control CPL during executing the vulnerable instructions (SGDT, SIDT, SLDT, SMSW, STR).
Emin, thanks for this info, very good to know that. I will check the latest IA SDM to see that feature.
Delete