bSchnepp / pantheon

Tiny operating system for aarch64 devices
5 stars 0 forks source link

[BUG] - System calls aren't sanitized #28

Open bSchnepp opened 2 years ago

bSchnepp commented 2 years ago

Issue Checklist

===================================================== Bug Description A userland process issuing a system call (ie, svcCreateNamedEvent) can pass in arbitrary values to the kernel. These do not necessarily have to be valid arguments: they could be invalid memory, memory owned by another process, etc.

To Reproduce Please list the steps to produce the bug below:

  1. Modify a system call such as svcCreateNamedEvent in existing code (ie, sysm) to be invalid
  2. Undesired behavior is now triggered

Screenshots If relevant, please provide screenshots here.

Expected behavior The kernel returns an error, or refuses to complete the request

Additional information This is a very serious bug. Any (and all) system calls need to be checked through some method of copyin/copyout from userland to a temporary kernel buffer to check if it's valid or not. Otherwise, issues like this could occur.

bSchnepp commented 2 years ago

Is this still valid for all system calls? Should review this later: everything should be OK now, but there might be some cases missing.