syscall_handler() in syscall.c ignores the page tables' PTE_USER bit entirely once execution reaches ring0, meaning nothing in the paging setup stops the kernel from dereferencing any address a ring3 .t program passes as a syscall argument. SYS_INFLATE, SYS_GFX_BLIT, and SYS_AUDIO_SUBMIT each took a pointer (or a pointer embedded in an argument struct) straight from ring3 without checking it actually belonged to the calling program's own memory before using it. SYS_INFLATE's args->out is the raw-DEFLATE decompression output target: with no validation, a ring3 program could point it at arbitrary kernel memory (page tables, function pointers, the syscall dispatch table) and supply crafted compressed input it fully controls, giving an arbitrary kernel-memory write of fully attacker-chosen content from a single syscall — a direct path to local privilege escalation. SYS_GFX_BLIT's args->pixels (bulk-copied into the visible linear framebuffer) and SYS_AUDIO_SUBMIT's source buffer (copied into an audio DMA buffer) are read-side equivalents: pointed at kernel memory, their contents become observable via the screen or, in principle, audio output, an information-disclosure primitive of arbitrary kernel memory. All three syscalls are reachable by any unprivileged ring3 .t executable with no special permissions.
CWE-787, CWE-125, CWE-284
ArtficalAI tAI 4.2