syzkaller

syzkaller - 커널 퍼저 syzkaller siːzˈkɔːlə는 비지도unsupervised 커버리지 기반 커널 퍼저입니다. 지원 OS: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows. 메일링 리스트: [email protected] 웹에서 가입하거나 이메일로 가입. 발견된 버그: Darwin/XNU, FreeBSD, Linux, NetBSD, OpenBSD, Windows. 문서 처음에 syzkaller는 Linux 커널 퍼징을 염두에 두고 개발되었지만...

CVE-2022-29968

CVE-2022-29968 CVE-2022-29968에 대한 개념 증명 익스플로잇입니다. Linux 커널, 특히 iouring 시스템에서의 초기화되지 않은 메모리 취약점입니다. 이 크래시는 Syzkaller로 발견되었습니다. 크래시 분석은 Joseph Ravichandran과 Michael Wang이 수행했습니다. 익스플로잇은 Joseph Ravichandran이 작성했습니다. 이 버그는 6.858 at MIT, Spring 2022 최종 프로젝트의 일환으로 발견 및 보고되었습니다. 3e08773c3841 "block:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: kernfs: A use-after-free issue has been fixed in kernfsremove. Syzkaller managed to trigger concurrent calls to kernfsremovebynamens for the same file, resulting in a KASAN detected use-after-free. This race condition occurs...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: htchst: In the ath9khtcrxmsg function, if there is no callback function, the provided skb is not freed. It is stated that ath9khtcrxmsg either frees the provided skb or passes its management to another callback...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fixed the lockdep issue in qdisctreereducebacklog The qdisctreereducebacklog function is called with the qdisc lock held, not RTNL. We must use qdisclookuprcu instead of qdisclookup. syzbot reported: WARNING:...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gtp: Fixed a use-after-free in gtpencapdestroy. syzkaller reported a use-after-free in gtpencapdestroy. The same process freed “sk” and accessed it illegally. The commit e198987e7dd7 “gtp: fix suspicious RCU usage” added...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: Handling of integer overflows in kmallocreserve The committed change was as follows: c ptr = kmallocsize; if ptr size = ksizeptr; size = kmallocsizeroundupsize; ptr = kmallocsize; This caused various crashes, as reported ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/ipv6: avoided a possible Use After Free UAF in ip6routempathnotify syzbot discovered another use-after-free in ip6routempath Notify. 1 The commit f7225172f25a “net/ipv6: prevent use after free in ip6routempath Notify” fail...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ax25: The refcount leak caused by setting the SOBINDTODEVICE socket option has been fixed. If an AX25 device is bound to a socket by setting the SOBINDTODEVICE socket option, a refcount leak will occur in ax25release. The commit...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, hsr: rejecting HSR frames if skb cannot hold the tag. Receiving an HSR frame with insufficient space to hold the HSR tag in the skb can result in a crash kernel BUG. 45.390915 skbuff: skbunderpanic:...

CVE-2023-52927

CVE-2023-52927 CVE-2023-52927용 LPE 익스플로잇 - netfilter의 Use-After-Free 취약점. 취약점에 대한 제 글: CVE-2023-52927 - 잊혀진 Syzkaller 리포트를 kCTF 익스플로잇으로 전환하기 재현기: KASAN 트리거 poc 빌드 의존성 설치: make prerequisites 익스플로잇 빌드: make exploit 대상 kCTF cos-109-17800.436.33 머신: 커널 이미지 bzImage:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpfsockaddr Syzkaller identified a kernel warning in the bpfsockaddr function: c 0: r0 = 0 1: r2 = u32 r1 + 60 2: exit This triggers the verifier bug: an error occurs during the context access...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Squashfs: fixed an issue where uninit-value was accessed in squashfsgetparent. Syzkaller reported a bug titled “KMSAN: uninit-value in squashfsgetparent”. This issue arises when openbyhandleat is called with a file handle...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: core: removed the unnecessary WARNON function in the implement function. The syzkaller triggered a warning 1 when calling implement, attempting to write a value into a field of smaller size in an output report. Since impleme...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: x86: stopped the use of stack-based calculations in the profilepc function. The profilepc function is used for timer-based profiling, which isn’t really that relevant anymore. It also makes assumptions about the stack layout that...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Block, bfq: Fixed a potential UAF issue for bfqq-bic when using the merge chain. 1. Initial state: Three tasks: - Process 1 Process 2 Process 3 - BIC1 BIC2 BIC3 | Λ | Λ | Λ | | | | | V | V | V bfqq1 bfqq2 bfqq3 Process...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: TCP: Fixed corruption in MPTCP’s DSS due to large PMTU transmissions. Syzkaller was able to trigger DSS corruption: - TCP: requestsocksubflowv4: Possible SYN flooding on port :::20002. Sending cookies. ------------ Cut here...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: schsfq: do not allow a 1 packet limit The current implementation does not work correctly with a limit of 1 packet. iproute2 actually checks for this, and this patch adds this check as well in the kernel. This fix resolv...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: Properly handling disconnections due to fastopen. Syzbot was able to trigger data stream corruption: WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 mptcpcleanuna+0xddb/0xff0 net/mptcp/protocol.c:1024 Modules...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed an out-of-bounds read when checking .dotdot dir. Mounting a corrupted filesystem with a directory containing a . dir entry where reclen == block size results in an out-of-bounds read later, when the corrupted director...