You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A related or similar issue is not already marked as open
The steps to reproduce have been tested, and do produce the issue described
If relevant, graphical issues have a screenshot presented as well. Text-only issues have the text and it's correct version listed within a Markdown code block section
The most recent commit on the master branch the bug is present in, with it's commit hash, is listed in this report
===================================================== Bug Description
A userland process issuing a system call (ie, svcCreateNamedEvent) can pass in arbitrary values to the kernel.
These do not necessarily have to be valid arguments: they could be invalid memory, memory owned by another process, etc.
To Reproduce
Please list the steps to produce the bug below:
Modify a system call such as svcCreateNamedEvent in existing code (ie, sysm) to be invalid
Undesired behavior is now triggered
Screenshots
If relevant, please provide screenshots here.
Expected behavior
The kernel returns an error, or refuses to complete the request
Additional information
This is a very serious bug. Any (and all) system calls need to be checked through some method of copyin/copyout from userland to a temporary kernel buffer to check if it's valid or not. Otherwise, issues like this could occur.
The text was updated successfully, but these errors were encountered:
Issue Checklist
master
branch the bug is present in, with it's commit hash, is listed in this report=====================================================
Bug Description
A userland process issuing a system call (ie, svcCreateNamedEvent) can pass in arbitrary values to the kernel.
These do not necessarily have to be valid arguments: they could be invalid memory, memory owned by another process, etc.
To Reproduce
Please list the steps to produce the bug below:
Screenshots
If relevant, please provide screenshots here.
Expected behavior
The kernel returns an error, or refuses to complete the request
Additional information
This is a very serious bug. Any (and all) system calls need to be checked through some method of copyin/copyout from userland to a temporary kernel buffer to check if it's valid or not. Otherwise, issues like this could occur.
The text was updated successfully, but these errors were encountered: