[x] A related or similar issue is not already marked as open
[x] The steps to reproduce have been tested, and do produce the issue described
[x] If relevant, graphical issues have a screenshot presented as well. Text-only issues have the text and it's correct version listed within a Markdown code block section
[x] The most recent commit on the master branch the bug is present in, with it's commit hash, is listed in this report
=====================================================
Bug Description
A userland process issuing a system call (ie, svcCreateNamedEvent) can pass in arbitrary values to the kernel.
These do not necessarily have to be valid arguments: they could be invalid memory, memory owned by another process, etc.
To Reproduce
Please list the steps to produce the bug below:
Modify a system call such as svcCreateNamedEvent in existing code (ie, sysm) to be invalid
Undesired behavior is now triggered
Screenshots
If relevant, please provide screenshots here.
Expected behavior
The kernel returns an error, or refuses to complete the request
Additional information
This is a very serious bug. Any (and all) system calls need to be checked through some method of copyin/copyout from userland to a temporary kernel buffer to check if it's valid or not. Otherwise, issues like this could occur.
Issue Checklist
master
branch the bug is present in, with it's commit hash, is listed in this report===================================================== Bug Description A userland process issuing a system call (ie, svcCreateNamedEvent) can pass in arbitrary values to the kernel. These do not necessarily have to be valid arguments: they could be invalid memory, memory owned by another process, etc.
To Reproduce Please list the steps to produce the bug below:
Screenshots If relevant, please provide screenshots here.
Expected behavior The kernel returns an error, or refuses to complete the request
Additional information This is a very serious bug. Any (and all) system calls need to be checked through some method of copyin/copyout from userland to a temporary kernel buffer to check if it's valid or not. Otherwise, issues like this could occur.