Re: Vulnerabilities in Synchronous IPC Designs

[Niels Möller]

Jean-Charles Salzeber <address@hidden> writes:

> This is exactly what is taken up in the L4 X2 ref manual:
> | Pagefaults Three different types of pagefault can occur during ipc:
> | pre-send, post-receive, and xfer pagefaults. Only xfer pagefault are
> | critical from a security point of view.

> So the question is: Is there any way to avoid denial of service if a
> malicious client such send messages?

I can see at least two different approaches:

1. Let xfer-timout=0 mean that the ipc should fail when the first page
   fault happens. The communicating threads have to ensure that their
   buffers are paged in before theipc call, and remain paged in during
   the call. I think this is a minor change to the L4 API.

2. Use one server thread per user. Then any user can only DOS-attack
   his or her own processes.

/Niels