Skip to content
Commit 3a2af7cc authored by Jinbum Park's avatar Jinbum Park Committed by Johannes Berg
Browse files

mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom

User controls @idx which to be used as index of hwsim_world_regdom_custom.
So, It can be exploited via Spectre-like attack. (speculative execution)

This kind of attack leaks address of hwsim_world_regdom_custom,
It leads an attacker to bypass security mechanism such as KASLR.

So sanitize @idx before using it to prevent attack.

I leveraged strategy [1] to find and exploit this gadget.

[1] https://github.com/jinb-park/linux-exploit/tree/master/exploit-remaining-spectre-gadget/



Signed-off-by: default avatarJinbum Park <jinb.park7@gmail.com>
[johannes: unwrap URL]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 20932750
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment