https://github.com/torvalds/linux
Revision ccbe495caa5e604b04d5a31d7459a6f6a76a756c authored by Roland McGrath on 28 February 2009, 03:03:24 UTC, committed by Linus Torvalds on 02 March 2009, 23:41:30 UTC
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call.  A 64-bit process make a 32-bit system call with int $0x80.

In both these cases, audit_syscall_entry() will use the wrong system
call number table and the wrong system call argument registers.  This
could be used to circumvent a syscall audit configuration that filters
based on the syscall numbers or argument details.

Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 778ef1e
History
Tip revision: ccbe495caa5e604b04d5a31d7459a6f6a76a756c authored by Roland McGrath on 28 February 2009, 03:03:24 UTC
x86-64: syscall-audit: fix 32/64 syscall hole
Tip revision: ccbe495
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
usr
virt
.gitignore -rw-r--r-- 867 bytes
.mailmap -rw-r--r-- 3.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.3 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 107.1 KB
Makefile -rw-r--r-- 53.2 KB
README -rw-r--r-- 16.7 KB
REPORTING-BUGS -rw-r--r-- 3.1 KB

README

back to top