[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160119154923.GA5130@chrystal.uk.oracle.com>
Date: Tue, 19 Jan 2016 16:49:23 +0100
From: Quentin Casasnovas <quentin.casasnovas@...cle.com>
To: kernel-hardening@...ts.openwall.com
Cc: Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: 2015 kernel CVEs
On Tue, Jan 19, 2016 at 12:49:17PM +0100, Hanno Böck wrote:
> On Tue, 19 Jan 2016 14:28:12 +0300
> Dan Carpenter <dan.carpenter@...cle.com> wrote:
>
> > There was only a coupls CVEs that looks like they came from a
> > filesystem fuzzer where you create a corrupt filesystems and then try
> > use them.
>
> I tried that, but it didn't lead to any results in the kernel [1].
> What I did:
> * Use filesystem checking tools (fsck) and fuzz them with afl
> * Use the queue created by afl and try to mount these with a
> kasan-enabled kernel
>
> My conclusion was that the filesystem code in the kernel is relatively
> robust (at least robust enough for this trivial fuzzing).
> But it led to a number of bugs discovered in filesystem fsck tools.
>
As an experimental toy project, we've managed to implement the glue to have
AFL run on the kernel code, using either a patched afl-as wrapper or a
slightly modified GCC extension written by Dmitry Vyukov for syzkaller
(-fsanitize-coverage=trace-pc), and our conclusion is quite different.
In the month Vegard Nossum has been using it, he reported at least a dozen
problems at mount or readdir time:
btrfs:
https://www.mail-archive.com/linux-btrfs@vger.kernel.org/msg48448.html
https://www.mail-archive.com/linux-btrfs@vger.kernel.org/msg48976.html
https://www.mail-archive.com/linux-btrfs@vger.kernel.org/msg49011.html
ext4:
http://marc.info/?l=linux-ext4&m=144898824424465&w=2
https://lkml.org/lkml/2015/12/13/187
hfs:
http://marc.info/?l=linux-fsdevel&m=144900215929323&w=2
isofs:
https://marc.info/?l=linux-kernel&m=144933509518680&w=2
udf:
https://lkml.org/lkml/2015/12/10/438
https://lkml.org/lkml/2015/12/11/526
vfat:
https://lkml.org/lkml/2015/11/13/782
https://lkml.org/lkml/2015/11/23/36
xfs:
https://marc.info/?l=linux-xfs&m=144904267207656&w=2
It should be noted that most of these problems were found relatively
quickly and without changing much the filesystem code, checksums weren't
disabled for example a part for superblock checksum in btrfs. And that was
mostly fuzzing the mount/readdir syscalls so a lot more can probably be
found there.
Thanks,
Quentin
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
