Re: net/udp: slab-out-of-bounds Read in udp_recvmsg

2017-03-15 Thread Eric Dumazet
On Wed, 2017-03-15 at 15:08 -0700, David Miller wrote: > From: Eric Dumazet > Date: Wed, 15 Mar 2017 09:10:33 -0700 > > > @@ -692,12 +692,17 @@ void __sock_recv_timestamp(struct msghdr *msg, struct > > sock *sk, > > ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2)) > >

Re: net/udp: slab-out-of-bounds Read in udp_recvmsg

2017-03-15 Thread David Miller
From: Eric Dumazet Date: Wed, 15 Mar 2017 09:10:33 -0700 > @@ -692,12 +692,17 @@ void __sock_recv_timestamp(struct msghdr *msg, struct > sock *sk, > ktime_to_timespec_cond(shhwtstamps->hwtstamp, tss.ts + 2)) > empty = 0; > if (!empty) { > + unsigned int

Re: net/udp: slab-out-of-bounds Read in udp_recvmsg

2017-03-15 Thread Eric Dumazet
On Wed, 2017-03-15 at 09:01 -0700, Eric Dumazet wrote: > On Wed, 2017-03-15 at 16:41 +0100, Dmitry Vyukov wrote: > > On Wed, Mar 15, 2017 at 4:25 PM, 쪼르 wrote: > > > It seems that attacker can leak kernel memory(slab) by this vulnerability. > > > I make a PoC code, and it works well on > > > ae50d

Re: net/udp: slab-out-of-bounds Read in udp_recvmsg

2017-03-15 Thread Eric Dumazet
On Wed, 2017-03-15 at 16:41 +0100, Dmitry Vyukov wrote: > On Wed, Mar 15, 2017 at 4:25 PM, 쪼르 wrote: > > It seems that attacker can leak kernel memory(slab) by this vulnerability. > > I make a PoC code, and it works well on > > ae50dfd61665086e617cc9e554a1285d52765670. > > but, I found that PoC wa

Re: net/udp: slab-out-of-bounds Read in udp_recvmsg

2017-03-15 Thread Dmitry Vyukov
On Wed, Mar 15, 2017 at 4:25 PM, 쪼르 wrote: > It seems that attacker can leak kernel memory(slab) by this vulnerability. > I make a PoC code, and it works well on > ae50dfd61665086e617cc9e554a1285d52765670. > but, I found that PoC wasn't work on Ubuntu16.04.02 4.4.0-64-generic > #85-Ubuntu SMP. D