linux-kernel - Re: [RFC] unix: fix use-after-free in unix_dgram

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 02 Nov 2015 21:55:42 +0000
From:	Rainer Weikusat <rweikusat@...ileactivedefense.com>
To:	<olivier@...ras.ch>
Cc:	Rainer Weikusat <rweikusat@...ileactivedefense.com>,
	Jason Baron <jbaron@...mai.com>, <davem@...emloft.net>,
	<netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<minipli@...glemail.com>, <normalperson@...t.net>,
	<eric.dumazet@...il.com>, <viro@...iv.linux.org.uk>,
	<davidel@...ilserver.org>, <dave@...olabs.net>,
	<pageexec@...email.hu>, <torvalds@...ux-foundation.org>,
	<peterz@...radead.org>
Subject: Re: [RFC] unix: fix use-after-free in unix_dgram_poll()/ 4.2.5

Olivier Mauras <olivier@...ras.ch> writes:

[...]

> I've encountered  issues with Jason's patch ported to 3.14.x which would break
> openldap, rendering it unable to answer any query - Here's a strace of the
> slapd process in this state http://pastebin.ca/3226383
> Just ported Rainer's patch to 3.14 and so far I can't reproduce the issue -

I may be missing something here but the final state according to the
trace it that thread 775 of the process blocks in epoll_wait with a
descriptor set containing only a listening TCP socket (8) and waiting
for new connections. I don't think this can execute any code
changed by my patch and I'm fairly certain for this for Jason's, too:
Both are about AF_UNIX datagram sockets and the specific case where
either a write couldn't complete because the backlog of the receive
queue of the 1 side of a n:1 datagram socket arrangement was considered
too large or where a 'poll for write' check returned 'not writeable' for
the same reason.

Judging from the 2.4.42 sources, OpenLDAP doesn't use AF_UNIX datagram
sockets at all so it shouldn't ever be affected by any changes to the
code handling them.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/