Kernel-hardening archive on
 help / color / Atom feed
* Maybe inappropriate use BUG_ON() in CONFIG_SLAB_FREELIST_HARDENED
@ 2020-02-13 15:16 zerons
  0 siblings, 0 replies; only message in thread
From: zerons @ 2020-02-13 15:16 UTC (permalink / raw)
  To: kernel-hardening; +Cc: Shawn, spender


In slub.c(,
for SLAB_FREELIST_HARDENED, an extra detection of the double free bug has been added.

This patch can (maybe only) detect something like this: kfree(a) kfree(a).
However, it does nothing when another process calls kfree(b) between the two kfree above.

The problem is, if the panic_on_oops option is not set(Ubuntu 16.04/18.04 default option),
for a bug which kfree an object twice in a row, if another process can preempt the process
triggered this bug and then call kmalloc() to get the object, the patch doesn't work.

Case 0: failure race
Process A:
the patch could terminate Process A.

Case 1: race done
Process A:
Process B:
	kmalloc() -> a
Process A:
the patch does nothing.

The attacker can check the return status of process A to see if the race is done.

Without this extra detection, the kernel could be unstable while the attacker
trying to do the race.
In my opinion, this patch can somehow help attacker exploit this kind of bugs
more reliable.

Best Regards,

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-13 15:16 Maybe inappropriate use BUG_ON() in CONFIG_SLAB_FREELIST_HARDENED zerons

Kernel-hardening archive on

Archives are clonable:
	git clone --mirror kernel-hardening/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 kernel-hardening kernel-hardening/ \
	public-inbox-index kernel-hardening

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone