d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bee8d4f213
freebsd-dev/sys/dev/drm
History
Robert Noland bee8d4f213 drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) 
Olaf Kirch noticed that the i915_set_status_page() function of the i915
kernel driver calls ioremap with an address offset that is supplied by
userspace via ioctl. The function zeroes the mapped memory via memset
and tells the hardware about the address. Turns out that access to that
ioctl is not restricted to root so users could probably exploit that to
do nasty things. We haven't tried to write actual exploit code though.

It only affects the Intel G33 series and newer.

Approved by:	bz (secteam)
Obtained from:	Intel drm repo
Security:	CVE-2008-3831
2008-10-25 16:29:28 +00:00
..
ati_pcigart.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_agpsupport.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_atomic.h resync to git master 2008-10-03 16:59:11 +00:00
drm_auth.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_bufs.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_context.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_dma.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_drawable.c Correct memory leak of info->rects. Previously we would free info, but 2008-10-13 18:06:33 +00:00
drm_drv.c Replace calls to minor() with dev2unit(). Ed already fixed this once, 2008-10-23 20:23:03 +00:00
drm_fops.c Replace calls to minor() with dev2unit(). Ed already fixed this once, 2008-10-23 20:23:03 +00:00
drm_internal.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
drm_ioctl.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_irq.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_linux_list.h The linux list compat code had an error which prevented list_for_each_safe() 2008-10-13 17:52:41 +00:00
drm_lock.c This check is invalid and I disabled it once already. I accidentally 2008-10-23 20:19:56 +00:00
drm_memory.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_pci.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_pciids.h Several of the newer radeon cards have moved around the registers for enabling 2008-10-13 17:43:39 +00:00
drm_sarea.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
drm_scatter.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_sysctl.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
drm_vm.c resync to git master 2008-10-03 16:59:11 +00:00
drm-preprocess.sh Update to DRM CVS as of 2006-04-09. The most notable new feature is the updated 2006-04-09 20:45:45 +00:00
drm-subprocess.pl Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
drm.h resync to git master 2008-10-03 16:59:11 +00:00
drmP.h Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
i915_dma.c drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) 2008-10-25 16:29:28 +00:00
i915_drm.h resync to git master 2008-10-03 16:59:11 +00:00
i915_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
i915_drv.h resync to git master 2008-10-03 16:59:11 +00:00
i915_irq.c Correct the interrupt handling in the Intel i915 driver. 2008-10-13 17:47:13 +00:00
i915_mem.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
i915_suspend.c resync to git master 2008-10-03 16:59:11 +00:00
mach64_dma.c We should never call drm_pci_alloc() while holding locks, due the the 2008-09-09 02:05:03 +00:00
mach64_drm.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mach64_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
mach64_drv.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mach64_irq.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mach64_state.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mga_dma.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mga_drm.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mga_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
mga_drv.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mga_irq.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mga_state.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
mga_ucode.h Update DRM to CVS snapshot as of 2005-11-28. Notable changes: 2005-11-28 23:13:57 +00:00
mga_warp.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r128_cce.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r128_drm.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r128_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
r128_drv.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r128_irq.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r128_state.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r300_cmdbuf.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
r300_reg.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
radeon_cp.c Several of the newer radeon cards have moved around the registers for enabling 2008-10-13 17:43:39 +00:00
radeon_drm.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
radeon_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
radeon_drv.h Several of the newer radeon cards have moved around the registers for enabling 2008-10-13 17:43:39 +00:00
radeon_irq.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
radeon_mem.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
radeon_microcode.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
radeon_state.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
savage_bci.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
savage_drm.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
savage_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
savage_drv.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
savage_state.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
sis_drm.h Update DRM to CVS snapshot as of 2005-11-28. Notable changes: 2005-11-28 23:13:57 +00:00
sis_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
sis_drv.h Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
sis_ds.c Update to DRM CVS as of 2006-04-09. The most notable new feature is the updated 2006-04-09 20:45:45 +00:00
sis_ds.h Update to DRM CVS as of 2006-04-09. The most notable new feature is the updated 2006-04-09 20:45:45 +00:00
sis_mm.c Update drm kernel drivers. 2008-08-23 20:59:12 +00:00
tdfx_drv.c Rework memory allocation to allocate memory with different type names. This 2008-10-13 18:03:27 +00:00
tdfx_drv.h Update DRM to CVS snapshot as of 2005-11-28. Notable changes: 2005-11-28 23:13:57 +00:00