linux-kernel - Re: ftrace_kill() leads to kmalloc-512 UAF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Jul 2022 11:40:10 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Alexey Dobriyan <adobriyan@...il.com>
Cc:     mingo@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: ftrace_kill() leads to kmalloc-512 UAF

On Wed, 20 Jul 2022 18:22:25 +0300
Alexey Dobriyan <adobriyan@...il.com> wrote:

> Basically, if ftrace_kill() is ever called ever there is a ticking UAFbomb.

That's because ftrace_kill() means something horribly went wrong, and
because ftrace modifies the kernel text, it shuts everything down and this
needs to be fixed.

The fix is not to have something handle ftrace_kill(), it's to fix the
situation so that ftrace_kill() is not called.

Hmm, perhaps we should add an option to make ftrace_kill() call BUG().

I'll go back and take a look at your analysis.

Thanks,

-- Steve