DF variable out of sync with RFLAGS after the SYSCALL instruction

[Jakub Jermar]

Masking off the DF flag from the RFLAGS register during the SYSCALL instruction by specifying the DF bit in the SFMASK register doesn't work because the DF variable doesn't get updated. This bug allows a malicious userspace code to damage kernel memory on systems which rely on proper functionality of the SYSCALL instruction and the SFMASK register. Note that the same bug existed in qemu and was fixed in revision 4120:

​http://svn.savannah.gnu.org/viewvc?view=rev&root=qemu&revision=4120

[Sander van Leeuwen]

Fixed. Note that it was quite unlikely to hit this bug in the first place in VirtualBox. Syscall would only in very rare cases be executed in the recompiler.

Thanks for reporting it.