beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-26 09:30:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Kernel: Eliminate possible KASLR leak by disabling CR4.FSGSBASE

Browse source 
The RDGSBASE userspace instruction allows programs to read the contents
of the gs segment register which contains a kernel pointer to the base
of the current Processor struct.

Since we don't use this instruction in Serenity at the moment, we can
simply disable it for now to ensure we don't break KASLR. Support can
later be restored once proper swapping of the contents of gs is done on
userspace/kernel boundaries.
This commit is contained in:
Idan Horowitz 2022-06-22 00:03:10 +03:00
parent 2df56f840f
commit 1950e79d48
Notes: sideshowbarker 2024-07-17 11:29:41 +09:00 
Author: https://github.com/IdanHo
Commit: https://github.com/SerenityOS/serenity/commit/1950e79d48
Pull-request: https://github.com/SerenityOS/serenity/pull/14353
Reviewed-by: https://github.com/bgianfo ✅
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Kernel/Arch/x86/common/Processor.cpp
View file

@ -593,6 +593,12 @@ UNMAP_AFTER_INIT void Processor::cpu_setup()
constexpr u64 rflags_mask = 0x257fd5u;
MSR sfmask_msr(MSR_SFMASK);
sfmask_msr.set(rflags_mask);
if (has_feature(CPUFeature::FSGSBASE)) {
// Turn off CR4.FSGSBASE to ensure the current Processor base kernel address is not leaked via
// the RDGSBASE instruction until we implement proper GS swapping at the userspace/kernel boundaries
write_cr4(read_cr4() & ~0x10000);
}
#endif
// Query OS-enabled CPUID features again, and set the flags if needed.