[PATCH v2 2/3] x86: Remap GDT tables in the Fixmap section

2017-01-26 Thread Thomas Garnier
Each processor holds a GDT in its per-cpu structure. The sgdt instruction gives the base address of the current GDT. This address can be used to bypass KASLR memory randomization. With another bug, an attacker could target other per-cpu structures or deduce the base of the main memory section

[PATCH v2 2/3] x86: Remap GDT tables in the Fixmap section

2017-01-26 Thread Thomas Garnier
Each processor holds a GDT in its per-cpu structure. The sgdt instruction gives the base address of the current GDT. This address can be used to bypass KASLR memory randomization. With another bug, an attacker could target other per-cpu structures or deduce the base of the main memory section