lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 13 Mar 2012 16:23:38 -0400
From:	Dave Jones <>
To:	"Eric W. Biederman" <>
Cc:, Linux Kernel <>
Subject: Re: tun oops dereferencing garbage nsproxy-> address.

On Tue, Mar 13, 2012 at 01:10:06PM -0700, Eric W. Biederman wrote:

 > >  > > My guess is the fuzzer called some syscall that set current->nsproxy
 > >  > > to garbage (0x0000000100000001), which later got dereferenced when it
 > >  > > subsequently randomly did an open() on tun.
 > >  > 
 > >  > It smells like a memory stomp.  current->nsproxy is always supposed to
 > >  > have a valid value, and it never would have an odd value.  The value
 > >  > should always be at least 8 byte aligned.
 > >  > 
 > >  > Since the value is impossible this doesn't feel like a path where the
 > >  > error handling is wrong.
 > >
 > > 0x0000000100000001 looks like one of strange values my fuzzer passes syscalls
 > > when they ask for an address.
 > >
 > > So something managed to get that set as nsproxy.  The fuzzer avoids calling
 > > clone(), so are there other syscalls that might set this ?
 > setns and unshare might touch the nsproxy for the same reasons as clone,
 > but the rules are very similar to clone.

Hmm, the only way that seems possible to set nsproxy is if the process was run
with CAP_SYS_ADMIN, which it wasn't.

Maybe your theory holds water, and something else wrote that value to the
current thread at a random offset. Fun.

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists