Kernel: Don't allow modifying IOPL via sys$ptrace() or sys$sigreturn()

It was possible to overwrite the entire EFLAGS register since we didn't
do any masking in the ptrace and sigreturn syscalls.

This made it trivial to gain IO privileges by raising IOPL to 3 and
then you could talk to hardware to do all kinds of nasty things.

Thanks to @allesctf for finding these issues! :^)

Their exploit/write-up: https://github.com/allesctf/writeups/blob/master/2020/hxpctf/wisdom2/writeup.md

1 files changed, 2 insertions, 0 deletions

diff --git a/Kernel/Arch/i386/CPU.h b/Kernel/Arch/i386/CPU.h
index c4d736dc15..39168b3be7 100644
--- a/Kernel/Arch/i386/CPU.h
+++ b/Kernel/Arch/i386/CPU.h
@@ -43,6 +43,8 @@ class MemoryManager;
 class PageDirectory;
 class PageTableEntry;
 
+static constexpr u32 safe_eflags_mask = 0xdff;
+
 struct [[gnu::packed]] DescriptorTablePointer
 {
     u16 limit;