Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 30 Aug 2020 17:34:09 -0700
From: Theodore Dubois <>
Subject: i386 __set_thread_area will crash if the syscall fails

Found a (small) bug in this file:

If the syscall fails, the branch on line 20 is taken and %eax will be a small negative number. Then "mov $123,%al" will make syscall 0xffffff7b instead of 0x7b, since overwriting %al only overwrites the low byte of %eax. So the modify_ldt fallback has apparently never worked.

Tangentially, I'm not sure why this file has so many hardcoded magic numbers and no comments to explain what they are.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.