From owner-freebsd-security@FreeBSD.ORG Fri Sep 18 17:20:56 2009 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B5CBE1065676 for ; Fri, 18 Sep 2009 17:20:56 +0000 (UTC) (envelope-from julian@elischer.org) Received: from outR.internet-mail-service.net (outr.internet-mail-service.net [216.240.47.241]) by mx1.freebsd.org (Postfix) with ESMTP id 994BE8FC22 for ; Fri, 18 Sep 2009 17:20:55 +0000 (UTC) Received: from idiom.com (mx0.idiom.com [216.240.32.160]) by out.internet-mail-service.net (Postfix) with ESMTP id 771A23E1D5; Fri, 18 Sep 2009 10:09:28 -0700 (PDT) X-Client-Authorized: MaGic Cook1e X-Client-Authorized: MaGic Cook1e X-Client-Authorized: MaGic Cook1e X-Client-Authorized: MaGic Cook1e Received: from julian-mac.elischer.org (home.elischer.org [216.240.48.38]) by idiom.com (Postfix) with ESMTP id DAEBB2D6012; Fri, 18 Sep 2009 10:09:27 -0700 (PDT) Message-ID: <4AB3BEC7.6090409@elischer.org> Date: Fri, 18 Sep 2009 10:09:27 -0700 From: Julian Elischer User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: =?ISO-8859-1?Q?Istv=E1n?= References: <4AAF4A64.3080906@thedarkside.nl> <20090919.001313.110616099.hdk_2@yahoo.co.jp> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-Mailman-Approved-At: Fri, 18 Sep 2009 18:06:25 +0000 Cc: pieter@thedarkside.nl, freebsd-security@freebsd.org Subject: Re: Protecting against kernel NULL-pointer derefs X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2009 17:20:56 -0000 István wrote: > the question is how much percent of the user are using wine and dosbox which > are going to break with this setting, i guess 10% or less. So those guys > could use _NO_VM_MIN kernel or something while the rest of the world would > fly high with secured kernel. The assumption is that the userland and kernel share a memory map. While we do implement it this way, it is not necessarily needed. We do it for performance reasons (each user memory map includes an identical top section that is the kernel space, so that we do not need to switch memory page arenas (change CR3) when entering the kernel. However it might be possible to not do this, and in fact on some hardware it is mandatory to not do this). It would require a page table arena switch with each syscall which would require flushing the TLBs which would be expensive.. Hmm I guess I've talked myself out of this as a solution.. :-) Julian > > to quote a security friend: > > the freebsd was the last target platform for this bugclass :)) > > regards, > Istvan > > > On Fri, Sep 18, 2009 at 4:13 PM, Hideki EIRAKU wrote: > >> From: Pieter de Boer >> Subject: Protecting against kernel NULL-pointer derefs >> Date: Tue, 15 Sep 2009 10:03:48 +0200 >> >>> - Are there unwanted side-effects of raising VM_MIN_ADDRESS? >> Mapping at address 0x0 is needed by some softwares using vm86 mode. >> For example, emulators/doscmd uses vm86 mode to emulate an old DOS >> environment. In this case, the address 0x0 - 0x3ff is used for an >> interrupt vector of emulated DOS world. If VM_MIN_ADDRESS is not zero, >> doscmd doesn't work. vm86 mode is in 32bit i386 architecture only, not >> in amd64 or other architectures. >> >> -- >> Hideki EIRAKU >> -------------------------------------- >> Thanks 10 years! Yahoo! Shopping and Yahoo! Auctions >> http://pr.mail.yahoo.co.jp/ec10years/ >> _______________________________________________ >> freebsd-security@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-security >> To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org >> " >> > > >