Date: Fri, 11 Sep 2015 04:44:06 +0900 From: sfjro@...rs.sourceforge.net To: Ben Hutchings <ben@...adent.org.uk> Cc: oss-security <oss-security@...ts.openwall.com> Subject: Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch Ben Hutchings: > The aufs (Advanced Union Filesystem) project provides an optional patch > for the Linux kernel, called either aufs3-mmap.patch or ::: > I posted a patch here that works for me: > http://sourceforge.net/p/aufs/mailman/message/34449209/ > > Please assign a CVE ID to this. I know this is a bug but I don't have time to fix it or test your patch. I am afraid your patch may introduce another problem because you don't handle vm_prfile. I still think get/put(vm_prfile) is necessary. Its lifetime should be equivalent to vm_file's essentially. How about the test case for the race condition between these? - groupA: msync or madvise - groupB: mmap and munmap As you might know, aufs mmap/munmap handle vm_file and vm_prfile. When aufs munmap calls fput(vm_prfile) and your patch doesn't fget(vm_prfile), then vm_prfile will be broken. And I am afraid it will cause a problem like use-after-free. I have no objection to assign a CVE ID, but I don't think it is fixed or at least I didn't confirmt yet. J. R. Okajima
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.