3 ms·

If you are talking about mapping kernel address space into userland Linux does that too (or at least did until Spectre). It's a performance win because you don

If you are talking about mapping kernel address space into userland Linux does that too (or at least did until Spectre). It's a performance win because you don't need to flush the TLB on every syscall. You can't normally access the data because only ring0 may actually read from it. GDI objects make these even more complicated because they were originally designed to be fully userspace, but were moved to kernel for performance reasons back in the NT 4 days. "Security" meant something quite different back in the early 90s when this was done.

saagarjha 7y ago
> You can't normally access the data because only ring0 may actually read from it. It seems like it's the case here where normal, unprivileged code can just read out kernel pointers. I don't know of any other well-used platform that makes it this easy.
- jdsully 7y ago
  Yup but that is a bug not the intended design. The intended design is kernel memory is mapped but not accessible. GDI just makes this much more difficult because of its history. FWIW most data in GDI objects is non critical. It doesn’t really matter if a process corrupts a brush to be red instead of green. So some GDI data is allowed to be user space accessible. The mixed ownership is indeed a design "flaw" but it comes from the fact that GDI was initially 100% userspace (in win NT). FWIW GDI has been superseded by D2D which has a better design.
  - burfog 7y ago
    GDI dates back to the very first version of Windows, which was capable of running on the 8088 CPU in real mode. The concept of "userspace" was pretty weak, since the CPU didn't support protected mode. GDI obviously ran with full CPU privileges and was built-in to Windows, so "initially 100% userspace" doesn't make very much sense unless you only count MS-DOS as being non-userspace.
    - jdsully 7y ago
      This is very much specific to NT's implementation. Originally they did the right thing and put it in userspace. Performance made them rethink that in NT 4. The NT story is most relevant since the vulnerable version in this story is a descendent of NT not of the DOS/Win 9X lineage. Windows NT is a from scratch rewrite. You are correct GDI as an interface predates NT and protected mode in general, but the codebase used in NT is a different implementation.

saagarjha 7y ago

> You can't normally access the data because only ring0 may actually read from it. It seems like it's the case here where normal, unprivileged code can just read out kernel pointers. I don't know of any other well-used platform that makes it this easy.

jdsully 7y ago
Yup but that is a bug not the intended design. The intended design is kernel memory is mapped but not accessible. GDI just makes this much more difficult because of its history. FWIW most data in GDI objects is non critical. It doesn’t really matter if a process corrupts a brush to be red instead of green. So some GDI data is allowed to be user space accessible. The mixed ownership is indeed a design "flaw" but it comes from the fact that GDI was initially 100% userspace (in win NT). FWIW GDI has been superseded by D2D which has a better design.
- burfog 7y ago
  GDI dates back to the very first version of Windows, which was capable of running on the 8088 CPU in real mode. The concept of "userspace" was pretty weak, since the CPU didn't support protected mode. GDI obviously ran with full CPU privileges and was built-in to Windows, so "initially 100% userspace" doesn't make very much sense unless you only count MS-DOS as being non-userspace.
  - jdsully 7y ago
    This is very much specific to NT's implementation. Originally they did the right thing and put it in userspace. Performance made them rethink that in NT 4. The NT story is most relevant since the vulnerable version in this story is a descendent of NT not of the DOS/Win 9X lineage. Windows NT is a from scratch rewrite. You are correct GDI as an interface predates NT and protected mode in general, but the codebase used in NT is a different implementation.