QEMU

linux-user does not check PROT_EXEC

Bug #1832916 reported by Richard Henderson on 2019-06-14

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	QEMU	Expired	Undecided	Unassigned

Bug Description

At no point do we actually verify that a page is PROT_EXEC before translating. All we end up verifying is that the page is readable. Not the same thing, obviously.

The following test case should work for any architecture, though I've only validated it for x86_64 and aarch64.

Tags:

Revision history for this message

Richard Henderson (rth) wrote on 2019-06-14:

z.c Edit (743 bytes, text/x-csrc)

Changed in qemu:
assignee:	nobody → Richard Henderson (rth)

Revision history for this message

Richard Henderson (rth) wrote on 2019-06-16:

It turns out we can't fix this without also fixing
our implementation of signal trampolines.

Changed in qemu:
status:	New → Confirmed

Alex Bennée (ajbennee) on 2019-06-17

tags:

added: testcase

Revision history for this message

Thomas Huth (th-huth) wrote on 2021-05-04: Moved bug report

This is an automated cleanup. This bug report has been moved to QEMU's
new bug tracker on gitlab.com and thus gets marked as 'expired' now.
Please continue with the discussion here:

https://gitlab.com/qemu-project/qemu/-/issues/122