linux-kernel - Re: Regression Bug: use-after-free Write in udf_close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <imutehbxk6edskhshe5bnvo7syx4kurpcj62gpkkabvgp6jq5e@s5pcx6kznehu>
Date: Mon, 6 Jan 2025 14:51:30 +0100
From: Jan Kara <jack@...e.cz>
To: Kun Hu <huk23@...udan.edu.cn>
Cc: jack@...e.com, linux-kernel@...r.kernel.org, 
	"jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: Regression Bug: use-after-free Write in udf_close_lvid

Hello!

On Thu 26-12-24 13:42:31, Kun Hu wrote:
> When using fuzzer tool to fuzz the latest Linux kernel, the following crash
> was triggered.
> 
> HEAD commit: 78d4f34e2115b517bcbfe7ec0d018bbbb6f9b0b8
> git tree: upstream
> Console output: https://drive.google.com/file/d/1z_7XDn7042k9LzqJgxa8Sj0WqRfmfkdQ/view?usp=sharing
> Kernel config: https://drive.google.com/file/d/1RhT5dFTs6Vx1U71PbpenN7TPtnPoa3NI/view?usp=sharing
> C reproducer: https://drive.google.com/file/d/1hbgE6cac58A7YK7N75JIB-1tZo0G20Cl/view?usp=drive_link
> Syzlang reproducer: https://drive.google.com/file/d/1hbgE6cac58A7YK7N75JIB-1tZo0G20Cl/view?usp=sharing

The syzlang reproducer seems to be missing (the link points to C code). As
a result one has to decipher what's actually happening from the C code
which is a bit tedious... Please fix that.

> Similar Bug: https://lkml.org/lkml/2022/5/24/336

I have checked your reproducer and as far as I can tell it will modify
block device under a mounted filesystem (trying to use the same loop device
for xfs and udf). Such action is effectively equivalent to corrupting
memory. Please make sure CONFIG_BLK_DEV_WRITE_MOUNTED is disabled in all
your kernel configs used for fuzzing to avoid these invalid reproducers.
Thanks!

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR