| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 24 Nov 2015 10:31:32 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: vyasevich@...il.com, linux-sctp@...r.kernel.org,
netdev <netdev@...r.kernel.org>
Cc: syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>,
Eric Dumazet <edumazet@...gle.com>,
Maciej Żenczykowski <maze@...gle.com>
Subject: Re: use-after-free in sctp_do_sm
On Tue, Nov 24, 2015 at 10:15 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> Hello,
>
> The following program triggers use-after-free in sctp_do_sm:
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <syscall.h>
> #include <string.h>
> #include <stdint.h>
>
> int main()
> {
> long r0 = syscall(SYS_socket, 0xaul, 0x80805ul, 0x0ul, 0, 0, 0);
> long r1 = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
> memcpy((void*)0x20002fe4,
> "\x0a\x00\x33\xe7\xeb\x9d\xcf\x61\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc5\xc8\x88\x64",
> 28);
> long r3 = syscall(SYS_bind, r0, 0x20002fe4ul, 0x1cul, 0, 0, 0);
> memcpy((void*)0x20000faa,
> "\x9b\x01\x7d\xcd\xb8\x6a\xc7\x3d\x09\x3a\x07\x00\xa7\xc4\xe9\xee\x0a\xd6\xec\xde\x26\x75\x5f\x22\xae\x4e\x33\x00\xb0\x76\x10\x70\xd6\xca\x19\xbc\x15\x83\xcf\x2e\xbc\x99\x0c\x5e\x83\x89\xc1\x44\x9c\x6e\x74\xd8\x5d\x5d\xd0\xf0\xdf\x47\xc0\x00\x71\x0b\x55\x4c\xab\xf0\xd8\x90\xd5\x92\x8c\x6e\x33\x22\x15\x5b\x19\xfb\xed\xdd\xa6\xac\xcb\x60\xcf\xe2\xde\xed\xdb\x95\x5c\xaa\x20\xa3",
> 94);
> memcpy((void*)0x2000033a,
> "\x02\x00\x33\xe2\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> 128);
> long r6 = syscall(SYS_sendto, r0, 0x20000faaul, 0x5eul,
> 0x81ul, 0x2000033aul, 0x80ul);
> return 0;
> }
>
>
> ==================================================================
> BUG: KASAN: use-after-free in sctp_do_sm+0x42f6/0x4f60 at addr ffff880036fa80a8
> Read of size 4 by task a.out/5664
> =============================================================================
> BUG kmalloc-4096 (Tainted: G B ): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> INFO: Allocated in sctp_association_new+0x6f/0x1ea0 age=8 cpu=1 pid=5664
> [< none >] kmem_cache_alloc_trace+0x1cf/0x220 ./mm/slab.c:3707
> [< none >] sctp_association_new+0x6f/0x1ea0
> [< none >] sctp_sendmsg+0x1954/0x28e0
> [< none >] inet_sendmsg+0x316/0x4f0 ./net/ipv4/af_inet.c:802
> [< inline >] __sock_sendmsg_nosec ./net/socket.c:641
> [< inline >] __sock_sendmsg ./net/socket.c:651
> [< none >] sock_sendmsg+0xca/0x110 ./net/socket.c:662
> [< none >] SYSC_sendto+0x208/0x350 ./net/socket.c:1841
> [< none >] SyS_sendto+0x40/0x50 ./net/socket.c:1862
> [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a
>
> INFO: Freed in sctp_association_put+0x150/0x250 age=14 cpu=1 pid=5664
> [< none >] kfree+0x199/0x1b0 ./mm/slab.c:1211
> [< none >] sctp_association_put+0x150/0x250
> [< none >] sctp_association_free+0x498/0x630
> [< none >] sctp_do_sm+0xd8b/0x4f60
> [< none >] sctp_primitive_SHUTDOWN+0xa9/0xd0
> [< none >] sctp_close+0x616/0x790
> [< none >] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471
> [< none >] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416
> [< inline >] constant_test_bit ././arch/x86/include/asm/bitops.h:321
> [< none >] sock_release+0x8d/0x200 ./net/socket.c:601
> [< none >] sock_close+0x16/0x20 ./net/socket.c:1188
> [< none >] __fput+0x21d/0x6e0 ./fs/file_table.c:265
> [< none >] ____fput+0x15/0x20 ./fs/file_table.c:84
> [< none >] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20
> [< inline >] __list_add ./include/linux/list.h:42
> [< inline >] list_add_tail ./include/linux/list.h:76
> [< inline >] list_move_tail ./include/linux/list.h:168
> [< inline >] reparent_leader ./kernel/exit.c:618
> [< inline >] forget_original_parent ./kernel/exit.c:669
> [< inline >] exit_notify ./kernel/exit.c:697
> [< none >] do_exit+0x809/0x2b90 ./kernel/exit.c:878
> [< none >] do_group_exit+0x108/0x320 ./kernel/exit.c:985
>
> INFO: Slab 0xffffea0000dbea00 objects=7 used=1 fp=0xffff880036fa8000
> flags=0x100000000004080
> INFO: Object 0xffff880036fa8000 @offset=0 fp=0xffff880036fad668
> CPU: 1 PID: 5664 Comm: a.out Tainted: G B 4.4.0-rc1+ #81
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff880061d6f700 ffffffff825d3336 ffff88003e806d00
> ffff880036fa8000 ffff880036fa8000 ffff880061d6f730 ffffffff81618784
> ffff88003e806d00 ffffea0000dbea00 ffff880036fa8000 0000000000000000
>
> Call Trace:
> [<ffffffff8162131e>] __asan_report_load4_noabort+0x3e/0x40
> [<ffffffff8475ac76>] sctp_do_sm+0x42f6/0x4f60
> [<ffffffff847b50e9>] sctp_primitive_SHUTDOWN+0xa9/0xd0
> [<ffffffff847a1426>] sctp_close+0x616/0x790
> [<ffffffff8409bb0d>] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471
> [<ffffffff84192cc0>] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416
> [< inline >] constant_test_bit ././arch/x86/include/asm/bitops.h:321
> [<ffffffff83dc78cd>] sock_release+0x8d/0x200 ./net/socket.c:601
> [<ffffffff83dc7a56>] sock_close+0x16/0x20 ./net/socket.c:1188
> [<ffffffff81662f5d>] __fput+0x21d/0x6e0 ./fs/file_table.c:265
> [<ffffffff816634a5>] ____fput+0x15/0x20 ./fs/file_table.c:84
> [<ffffffff812a33d3>] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20
> [< inline >] __list_add ./include/linux/list.h:42
> [< inline >] list_add_tail ./include/linux/list.h:76
> [< inline >] list_move_tail ./include/linux/list.h:168
> [< inline >] reparent_leader ./kernel/exit.c:618
> [< inline >] forget_original_parent ./kernel/exit.c:669
> [< inline >] exit_notify ./kernel/exit.c:697
> [<ffffffff812505d9>] do_exit+0x809/0x2b90 ./kernel/exit.c:878
> [<ffffffff81252ad8>] do_group_exit+0x108/0x320 ./kernel/exit.c:985
> [<ffffffff81252d0d>] SyS_exit_group+0x1d/0x20 ./kernel/exit.c:1002
> [<ffffffff84bf0c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
> ==================================================================
>
>
> I am on commit 90b55590c43258a157a2a143748455dcc50fbb53 of net-next (Nov 22).
>
>
> Thanks
strace output for your convenience:
socket(PF_INET6, SOCK_SEQPACKET|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 3
mmap(0x20000000, 65536, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
bind(3, {sa_family=AF_INET6, sin6_port=htons(13287),
inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=1640996331,
sin6_scope_id=1686685893}, 28) = 0
sendto(3, "\233\1}\315\270j\307=\t:\7\0\247\304\351\356\n\326\354\336&u_\"\256N3\0\260v\20p"...,
94, MSG_OOB|MSG_EOR, {sa_family=AF_INET, sin_port=htons(13282),
sin_addr=inet_addr("127.0.0.1")}, 128) = 94
exit_group(0) = ?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists