lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 13 Jan 2016 23:45:45 -0200 From: Marcelo Ricardo Leitner <marcelo.leitner@...il.com> To: YUAN Jia <Jia.Yuan@...atel-sbell.com.cn>, 'Dmitry Vyukov' <dvyukov@...gle.com>, Vlad Yasevich <vyasevich@...il.com>, Neil Horman <nhorman@...driver.com>, "David S. Miller" <davem@...emloft.net>, "linux-sctp@...r.kernel.org" <linux-sctp@...r.kernel.org>, netdev <netdev@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>, Eric Dumazet <edumazet@...gle.com> Cc: syzkaller <syzkaller@...glegroups.com>, Kostya Serebryany <kcc@...gle.com>, Alexander Potapenko <glider@...gle.com>, Sasha Levin <sasha.levin@...cle.com> Subject: Re: net/sctp: use-after-free in __sctp_connect Em 13-01-2016 23:37, YUAN Jia escreveu: > Hi Dmitry, > > I've tested your program, but found nothing happens. So, I suspect it may cause kernel crash only on some special kernel version? > I was just using kernel of 4.2.3. What about you? > > Richard Please don't top-post. Note that it doesn't necessarily crashes the system. syzkaller is using kasan to detect such type of invalid accesses, which in some conditions may lead to crashes, weird behavior or just nothing at all. It all depends on how much the memory was already changed after it was freed. > -----Original Message----- > From: linux-sctp-owner@...r.kernel.org [mailto:linux-sctp-owner@...r.kernel.org] On Behalf Of Dmitry Vyukov > Sent: 2016年1月13日 17:53 > To: Vlad Yasevich; Neil Horman; David S. Miller; linux-sctp@...r.kernel.org; netdev; LKML; Eric Dumazet; Marcelo Ricardo Leitner > Cc: syzkaller; Kostya Serebryany; Alexander Potapenko; Sasha Levin > Subject: net/sctp: use-after-free in __sctp_connect > ... > > On commit 03891f9c853d5c4473224478a1e03ea00d70ff8d (Jan 11). This is the git commit/(version) he was using --^ Marcelo
Powered by blists - more mailing lists