lkml.org 
[lkml]   [2012]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: tun oops dereferencing garbage nsproxy-> address.
On Tue, Mar 13, 2012 at 01:10:06PM -0700, Eric W. Biederman wrote:

> > > > My guess is the fuzzer called some syscall that set current->nsproxy
> > > > to garbage (0x0000000100000001), which later got dereferenced when it
> > > > subsequently randomly did an open() on tun.
> > >
> > > It smells like a memory stomp. current->nsproxy is always supposed to
> > > have a valid value, and it never would have an odd value. The value
> > > should always be at least 8 byte aligned.
> > >
> > > Since the value is impossible this doesn't feel like a path where the
> > > error handling is wrong.
> >
> > 0x0000000100000001 looks like one of strange values my fuzzer passes syscalls
> > when they ask for an address.
> >
> > So something managed to get that set as nsproxy. The fuzzer avoids calling
> > clone(), so are there other syscalls that might set this ?
>
> setns and unshare might touch the nsproxy for the same reasons as clone,
> but the rules are very similar to clone.

Hmm, the only way that seems possible to set nsproxy is if the process was run
with CAP_SYS_ADMIN, which it wasn't.

Maybe your theory holds water, and something else wrote that value to the
current thread at a random offset. Fun.

Dave


\
 
 \ /
  Last update: 2012-03-13 21:25    [W:0.043 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site