[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20191119060604.GB13175@pi3.com.pl>
Date: Tue, 19 Nov 2019 07:06:04 +0100
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: bug: LKRG kills VirtualBox host VMs
Hi,
Thanks for report. From what I can see LKRG is somehow right since during stack
walk it detected code which was executed from the page which doesn't belong to
any legally registered .text section (kernel core neither kernel module):
Nov 18 08:30:59 debian kernel: 0xffffffffc106513b
Nov 18 08:30:59 debian kernel: 0xffffffffc1065428
Nov 18 08:30:59 debian kernel: 0xffffffffc108817d
Nov 18 08:30:59 debian kernel: 0xffffffffc1088c24
However, it might be situation where VBox do some kind of JIT or any dynamic
code generation on dynamic page. I would be able to dig-in more when I set-up
repro environment for VirtualBox.
I can tell that I'm using VmWare and haven't seen problem under LKRG so far.
Thanks,
Adam
On Mon, Nov 18, 2019 at 06:58:00PM +0000, Patrick Schleizer wrote:
> Debian buster host. LKRG 0.7.
>
> This happened while VirtualBox 2 VMs were already running and installing
> LRKG.
>
> sudo dmesg | grep lkrg
> [ 336.576805] [p_lkrg] Loading LKRG...
> [ 337.126382] [p_lkrg] LKRG initialized successfully!
> [ 337.137161] [p_lkrg] <Exploit Detection> Not valid call - pCFI
> violation: process[EMT-2 | 2067] !!!
> [ 337.137164] [p_lkrg] <Exploit Detection> Frame[1] nr_entries[8]:
> [0xffffffffc106513b]. Full Stack:
> [ 337.137193] [p_lkrg] <Exploit Detection> Trying to kill process[EMT-2
> | 2067]!
> [ 337.137234] [p_lkrg] <Exploit Detection> Stack pointer corruption
> (ROP?) - pCFI violation: process[EMT-2 | 2067] !!!
> [ 337.137235] [p_lkrg] <Exploit Detection> Trying to kill process[EMT-2
> | 2067]!
> [ 337.485911] [p_lkrg] <Exploit Detection> Not valid call - pCFI
> violation: process[EMT-3 | 2116] !!!
> [ 337.485915] [p_lkrg] <Exploit Detection> Frame[1] nr_entries[8]:
> [0xffffffffc106513b]. Full Stack:
> [ 337.485959] [p_lkrg] <Exploit Detection> Trying to kill process[EMT-3
> | 2116]!
> [ 337.486014] [p_lkrg] <Exploit Detection> Stack pointer corruption
> (ROP?) - pCFI violation: process[EMT-3 | 2116] !!!
> [ 337.486016] [p_lkrg] <Exploit Detection> Trying to kill process[EMT-3
> | 2116]!
>
>
> This happened after reboot when trying start a VM:
>
> Nov 18 08:30:58 debian kernel: vboxdrv: 0000000000000000 VMMR0.r0
> Nov 18 08:30:59 debian kernel: vboxdrv: 0000000000000000 VBoxDDR0.r0
> Nov 18 08:30:59 debian kernel: vboxpci: created IOMMU domain
> 000000000278fc42
> Nov 18 08:30:59 debian kernel: [p_lkrg] <Exploit Detection> Not valid
> call - pCFI violation: process[EMT-1 | 5252] !!!
> Nov 18 08:30:59 debian kernel: [p_lkrg] <Exploit Detection> Frame[1]
> nr_entries[8]: [0xffffffffc106513b]. Full Stack:
> Nov 18 08:30:59 debian kernel: --- . ---
> Nov 18 08:30:59 debian kernel: schedule+0x1/0x80
> Nov 18 08:30:59 debian kernel: 0xffffffffc106513b
> Nov 18 08:30:59 debian kernel: 0xffffffffc1065428
> Nov 18 08:30:59 debian kernel: 0xffffffffc108817d
> Nov 18 08:30:59 debian kernel: 0xffffffffc1088c24
> Nov 18 08:30:59 debian kernel: supdrvIOCtl+0xca6/0x36a0 [vboxdrv]
> Nov 18 08:30:59 debian kernel: VBoxDrvLinuxIOCtl_6_0_14+0x15c/0x230
> [vboxdrv]
> Nov 18 08:30:59 debian kernel: do_vfs_ioctl+0xa4/0x630
> Nov 18 08:30:59 debian kernel: --- END ---
> Nov 18 08:30:59 debian kernel: [p_lkrg] <Exploit Detection> Trying to
> kill process[EMT-1 | 5252]!
> Nov 18 08:30:59 debian kernel: [p_lkrg] <Exploit Detection> Stack
> pointer corruption (ROP?) - pCFI violation: process[EMT-1 | 5252] !!!
> Nov 18 08:30:59 debian kernel: [p_lkrg] <Exploit Detection> Trying to
> kill process[EMT-1 | 5252]!
> Nov 18 08:30:59 debian kernel: vboxpci: freeing IOMMU domain
> 000000000278fc42
> Nov 18 08:31:08 debian kernel: [p_lkrg] System is clean!
> Nov 18 08:31:24 debian kernel: [p_lkrg] System is clean!
> Nov 18 08:31:28 debian kernel: [p_lkrg] System is clean!
> Nov 18 08:31:28 debian kernel: [p_lkrg] System is clean!
> Nov 18 08:31:39 debian kernel: [p_lkrg] System is clean!
>
> Kind regards,
> Patrick
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
