Syscalls that deal with pointers provided from the userspace do not validate whether the pointers actually point to the calling process' memory. In particular, sys_read can be used maliciously to write an arbitrary amount of bytes to an arbitrary address (including overwriting kernel function code), while sys_write can be used to read an arbitrary amount of bytes from an arbitrary address; other syscalls are less flexible but still offer the option to read/write to arbitrary addresses (e.g. sys_time, and possibly others).
This issue could be fixed by creating a function that checks if a given pointer belongs to the given process' memory map and using it to validate pointers provided by the syscall caller any time a read/write is performed.
Syscalls that deal with pointers provided from the userspace do not validate whether the pointers actually point to the calling process' memory. In particular,
sys_readcan be used maliciously to write an arbitrary amount of bytes to an arbitrary address (including overwriting kernel function code), whilesys_writecan be used to read an arbitrary amount of bytes from an arbitrary address; other syscalls are less flexible but still offer the option to read/write to arbitrary addresses (e.g.sys_time, and possibly others).This issue could be fixed by creating a function that checks if a given pointer belongs to the given process' memory map and using it to validate pointers provided by the syscall caller any time a read/write is performed.