b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
disabled 16-bit segments on 64-bit kernels due to an information
leak. However, it does seem that people are genuinely using Wine to
run old 16-bit Windows programs on Linux.
A proper fix for this ("espfix64") is coming in the upcoming merge
window, but as a temporary fix, create a sysctl to allow the
administrator to re-enable support for 16-bit segments.
It adds a "/proc/sys/abi/ldt16" sysctl that defaults to zero (off). If
you hit this issue and care about your old Windows program more than
you care about a kernel stack address information leak, you can do
echo 1 > /proc/sys/abi/ldt16
as root (add it to your startup scripts), and you should be ok.
The sysctl table is only added if you have COMPAT support enabled on
x86-64, but I assume anybody who runs old windows binaries very much
does that ;)
Signed-off-by: H. Peter Anvin <email address hidden>
Link: http://lkml.kernel.org/r/CA%<email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
Here's the fix as committed to the 3.14.6 kernel:
( Taken from https:/ /www.kernel. org/pub/ linux/kernel/ v3.0/ChangeLog- 3.14.6 )
commit 461a8fe47232a42 c5ba9e2ac57eed3 7df331a2e3
Author: Linus Torvalds <email address hidden>
Date: Wed May 14 16:33:54 2014 -0700
x86-64, modify_ldt: Make support for 16-bit segments a runtime option
commit fa81511bb0bbb2b 1aace3695ce869d a9762624ff upstream.
Checkin:
b3b42ac2cbae x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
disabled 16-bit segments on 64-bit kernels due to an information
leak. However, it does seem that people are genuinely using Wine to
run old 16-bit Windows programs on Linux.
A proper fix for this ("espfix64") is coming in the upcoming merge
window, but as a temporary fix, create a sysctl to allow the
administrator to re-enable support for 16-bit segments.
It adds a "/proc/ sys/abi/ ldt16" sysctl that defaults to zero (off). If
you hit this issue and care about your old Windows program more than
you care about a kernel stack address information leak, you can do
echo 1 > /proc/sys/abi/ldt16
as root (add it to your startup scripts), and you should be ok.
The sysctl table is only added if you have COMPAT support enabled on
x86-64, but I assume anybody who runs old windows binaries very much
does that ;)
Signed-off-by: H. Peter Anvin <email address hidden> lkml.kernel. org/r/CA%<email address hidden>
Link: http://
Signed-off-by: Greg Kroah-Hartman <email address hidden>