linux-kernel - Re: general protection fault in refill_obj

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZgtIuBlUVE1Lj_Tc@P9FQF9L96D>
Date: Mon, 1 Apr 2024 16:52:24 -0700
From: Roman Gushchin <roman.gushchin@...ux.dev>
To: Ubisectech Sirius <bugreport@...sectech.com>
Cc: linux-trace-kernel <linux-trace-kernel@...r.kernel.org>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	hannes <hannes@...xchg.org>, mhocko <mhocko@...nel.org>,
	"shakeel.butt" <shakeel.butt@...ux.dev>
Subject: Re: general protection fault in refill_obj_stock

On Mon, Apr 01, 2024 at 03:04:46PM +0800, Ubisectech Sirius wrote:
> Hello.
> We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7. Attached to the email were a PoC file of the issue.

Thank you for the report!

I tried to compile and run your test program for about half an hour
on a virtual machine running 6.7 with enabled KASAN, but wasn't able
to reproduce the problem.

Can you, please, share a bit more information? How long does it take
to reproduce? Do you mind sharing your kernel config? Is there anything special
about your setup? What are exact steps to reproduce the problem?
Is this problem reproducible on 6.6?

It's interesting that the problem looks like use-after-free for the objcg pointer
but happens in the context of udev-systemd, which I believe should be fairly stable
and it's cgroup is not going anywhere.

Thanks!