linux-kernel - Re: [syzbot] KASAN: use-after-free Read in fw_load_sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YLfGUNpTU5BE27IT@kroah.com>
Date:   Wed, 2 Jun 2021 19:56:32 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     SyzScope <syzscope@...il.com>
Cc:     Luis Chamberlain <mcgrof@...nel.org>,
        syzbot <syzbot+9b91d635e2b51efd6371@...kaller.appspotmail.com>,
        Martin Fuzzey <mfuzzey@...keon.com>,
        Shuah Khan <shuah@...nel.org>, linux-kernel@...r.kernel.org,
        rafael@...nel.org, sunjunyong@...omi.com, sunjy516@...il.com,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in fw_load_sysfs_fallback

On Wed, Jun 02, 2021 at 10:08:39AM -0700, SyzScope wrote:
> Hi,
> We have analyzed this bug and realize that it is security-critical.
> Specifically, according to our investigation, it will lead to a
> use-after-free write (instead of the originally reported use-after-free
> read) and thus highly likely exploitable. More details can be found at:
> 
> https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-fw_load_sysfs_fallback <https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-fw_load_sysfs_fallback>
> 
> 
> We understand that creating a patch can be time-consuming and there is
> probably a long list of bugs pending fixes. We hope that our security
> analysis can enable an informed decision on which bugs to fix first
> (prioritization).
> 
> Since the bug has been on syzbot for over two months (first found on
> 03-22-2020), it is best to have the bug fixed early enough to avoid it being
> weaponized.

Great, please work to provide a fix!  See the archives for more details
if you are curious about this.

thanks,

greg k-h