linux-kernel - Re: Regression Bug: use-after-free Write in udf_close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <15EE8B6F-2B32-48C8-BC44-2BA6FE4F6F77@m.fudan.edu.cn>
Date: Tue, 7 Jan 2025 16:48:52 +0800
From: Kun Hu <huk23@...udan.edu.cn>
To: Jan Kara <jack@...e.cz>
Cc: jack@...e.com,
 linux-kernel@...r.kernel.org,
 "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: Regression Bug: use-after-free Write in udf_close_lvid



> 2025年1月6日 22:19，Kun Hu <huk23@...udan.edu.cn> 写道：
> 
> 
>> 
>> The syzlang reproducer seems to be missing (the link points to C code). As
>> a result one has to decipher what's actually happening from the C code
>> which is a bit tedious... Please fix that.
> 
> Sorry for incorrect link, 
> 
> Syzlang Reproducer: https://drive.google.com/file/d/1vshdFSRaGY3N4wyFscZdjKZsMU5j0z6H/view?usp=sharing
> 
>> 
>>> Similar Bug: https://lkml.org/lkml/2022/5/24/336
>> 
>> I have checked your reproducer and as far as I can tell it will modify
>> block device under a mounted filesystem (trying to use the same loop device
>> for xfs and udf). Such action is effectively equivalent to corrupting
>> memory. Please make sure CONFIG_BLK_DEV_WRITE_MOUNTED is disabled in all
>> your kernel configs used for fuzzing to avoid these invalid reproducers.
>> Thanks!
>> 
> 
> OK. I'll retest and get back to you on the results of those issues you mentioned
> 
> —
> thanks，
> Kun Hu
> 


This crash has not been reproduced after disable CONFIG_BLK_DEV_WRITE_MOUNTED.

——
Thanks,
Kun Hu