d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bee8d4f213
freebsd-dev/sys
History
Robert Noland bee8d4f213 drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) 
Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.

It only affects the Intel G33 series and newer.

Approved by:	bz (secteam)
Obtained from:	Intel drm repo
Security:	CVE-2008-3831
2008-10-25 16:29:28 +00:00
..
amd64 Simplify AMD64_CPU_MODEL() and AMD64_CPU_FAMILY() macros as the base family 2008-10-22 17:36:52 +00:00
arm Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
boot Initial support of loader(8) for ARM machines running U-Boot. 2008-10-14 10:11:14 +00:00
bsm When MPSAFE ttys were merged, a new BSM audit event identifier was 2008-08-24 21:20:35 +00:00
cam Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
cddl Remove the struct thread unuseful argument from bufobj interface. 2008-10-10 21:23:50 +00:00
compat Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
conf Add a driver for flash memory that implements to the Common Flash 2008-10-25 06:18:12 +00:00
contrib Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
crypto Simplify session selection/allocation. 2008-08-09 20:01:01 +00:00
ddb Collect N identical (or near identical) mkdumpheader() implementations into 2008-10-01 22:08:53 +00:00
dev drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) 2008-10-25 16:29:28 +00:00
fs Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
gdb Commit SYSINIT() ;-adding patch missed in previous pass. 2008-03-16 13:02:04 +00:00
geom Allow dumps to partitions with a tag of 0. The legacy 2008-10-22 02:08:54 +00:00
gnu Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
i386 handle case where eflags represents actual flags value when 2008-10-25 04:46:02 +00:00
ia64 Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
isa MFp4 (my newcard tree): 2008-08-24 07:40:14 +00:00
kern Don't rely on the value of *statep without first taking the vnode interlock. 2008-10-24 16:04:10 +00:00
libkern Prefix the static shl function with '__' like its parent function __qdivrem to 2008-10-09 20:43:42 +00:00
mips Add mips/conf/DEFAULTS and populate it with: 2008-10-23 02:16:38 +00:00
modules After adding U3G_DEBUG to LINT we need to create the opt_u3g.h file when 2008-10-24 07:19:09 +00:00
net Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
net80211 Revert the removal of the MALLOC and FREE macros from the net80211 code. 2008-10-23 19:57:13 +00:00
netatalk Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
netgraph Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
netinet Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
netinet6 Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
netipsec Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
netipx Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
netnatm Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
netncp Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
netsmb Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
nfs Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT. 2008-03-25 09:39:02 +00:00
nfs4client Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
nfsclient Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
nfsserver Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
nlm Rename RPC's 'struct pmap' to 'struct portmap' to avoid confusing it with 2008-08-25 09:36:17 +00:00
opencrypto Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
pc98 Replace all calls to minor() with dev2unit(). 2008-09-27 08:51:18 +00:00
pccard
pci Implement miibus_statchg handler. It detects whether rl(4) 2008-10-25 03:41:36 +00:00
powerpc Enable the cfi(4) driver. 2008-10-25 06:25:15 +00:00
rpc Retire the MALLOC and FREE macros. They are an abomination unto style(9). 2008-10-23 15:53:51 +00:00
security Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
sparc64 Enable mpt(4) as some later models have on-board Fusion-MPT 2008-10-11 12:10:23 +00:00
sun4v Collect N identical (or near identical) mkdumpheader() implementations into 2008-10-01 22:08:53 +00:00
sys Add a driver for flash memory that implements to the Common Flash 2008-10-25 06:18:12 +00:00
tools Introduce a standalone shell script for embedding MFS image. 2008-02-05 10:46:30 +00:00
ufs Fix a number of style issues in the MALLOC / FREE commit. I've tried to 2008-10-23 20:26:15 +00:00
vm Update mmap() comment: no more block devices, so no more block device 2008-10-22 16:50:12 +00:00
xdr Add the new kernel-mode NFS Lock Manager. To use it instead of the 2008-03-26 15:23:12 +00:00
xen Fix evtchn initialization on SMP 2008-10-24 07:57:48 +00:00
Makefile Improve the glimpse target: don't index .svn and compile directories. 2008-08-15 14:11:30 +00:00