netdev - Re: Progress in ticket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Zn2LY7gGod2J4UpH@ural>
Date: Thu, 27 Jun 2024 18:55:15 +0300
From: Andrey Kalachev <kalachev@...mel.ru>
To: Michal Switala <michal.switala@...ogain.com>
Cc: davem@...emloft.net, kuba@...nel.org, kuznet@....inr.ac.ru,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	syzbot+e738404dcd14b620923c@...kaller.appspotmail.com,
	syzkaller-bugs@...glegroups.com, yoshfuji@...ux-ipv6.org,
	lvc-project@...uxtesting.org
Subject: Re: Progress in ticket

On Thu, Jun 27, 2024 at 01:55:44PM +0200, Michal Switala wrote:
>Hello,
>
>I am currently looking at this bug and checked your reproduction.
>Unfortunately, it doesn's set xfrm transformations in the same way as
>syz reproducer. The effect is that in xfrm_lookup_with_ifid, the packet goes to
>the nopol section instead of notransform as in the original.
>
>Regards
>Michal

Hi Michal.

Most likely system("ip xfrm policy update src 254.136.0.0/0 dst 255.1.0.0/0 dir out flag icmp") does not work.

syzkaller uses Busybox based disk images.

ip is present there (/sbin/ip), but it has limited functionality.
In particular, the xfrm framework commands are not supported.
The original reproducer worked with ipsec/xfrm via netlink.
The rewritten reproducer will work with a Debian-based image with iproute2 installed.
I made a Debian image of bullseye (the easiest way to do that is to use create-image.sh).

Regards,
Andrey