linux-kernel - Re: Regression Bug: use-after-free Write in udf_close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <DBD3D2BA-A561-4201-99AC-C15C41E8810D@m.fudan.edu.cn>
Date: Mon, 6 Jan 2025 22:19:25 +0800
From: Kun Hu <huk23@...udan.edu.cn>
To: Jan Kara <jack@...e.cz>
Cc: jack@...e.com,
 linux-kernel@...r.kernel.org,
 "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: Regression Bug: use-after-free Write in udf_close_lvid


> 
> The syzlang reproducer seems to be missing (the link points to C code). As
> a result one has to decipher what's actually happening from the C code
> which is a bit tedious... Please fix that.

Sorry for incorrect link, 

Syzlang Reproducer: https://drive.google.com/file/d/1vshdFSRaGY3N4wyFscZdjKZsMU5j0z6H/view?usp=sharing

> 
>> Similar Bug: https://lkml.org/lkml/2022/5/24/336
> 
> I have checked your reproducer and as far as I can tell it will modify
> block device under a mounted filesystem (trying to use the same loop device
> for xfs and udf). Such action is effectively equivalent to corrupting
> memory. Please make sure CONFIG_BLK_DEV_WRITE_MOUNTED is disabled in all
> your kernel configs used for fuzzing to avoid these invalid reproducers.
> Thanks!
> 

OK. I'll retest and get back to you on the results of those issues you mentioned

—
thanks，
Kun Hu