diff options
| author | Dianzhang Chen <[email protected]> | 2019-06-26 04:50:30 +0000 |
|---|---|---|
| committer | Thomas Gleixner <[email protected]> | 2019-06-27 21:48:04 +0000 |
| commit | 993773d11d45c90cb1c6481c2638c3d9f092ea5b (patch) | |
| tree | ed3029d1d5c44fed104a622db172ed6c090d3481 /fs/proc/array.c | |
| parent | x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() (diff) | |
| download | kernel-993773d11d45c90cb1c6481c2638c3d9f092ea5b.tar.gz kernel-993773d11d45c90cb1c6481c2638c3d9f092ea5b.zip | |
x86/tls: Fix possible spectre-v1 in do_get_thread_area()
The index to access the threads tls array is controlled by userspace
via syscall: sys_ptrace(), hence leading to a potential exploitation
of the Spectre variant 1 vulnerability.
The index can be controlled from:
ptrace -> arch_ptrace -> do_get_thread_area.
Fix this by sanitizing the user supplied index before using it to access
the p->thread.tls_array.
Signed-off-by: Dianzhang Chen <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Link: https://lkml.kernel.org/r/[email protected]
Diffstat (limited to 'fs/proc/array.c')
0 files changed, 0 insertions, 0 deletions