search

AFLplusplus / qemu-libafl-bridge

A patched QEMU that exposes an interface for LibAFL-based fuzzers
Other
57 stars 29 forks source link

clone: fix stack use after scope #44

Closed xdqi closed 8 months ago

xdqi commented 8 months ago

In QEMU's code handling clone, when clone creates a new thread, it does some QEMU stuff, creates a conditional variable and spawns a new thread. https://github.com/AFLplusplus/qemu-libafl-bridge/blob/99ea52d12369d0bd30717c57e65719a2644b7c68/linux-user/syscall.c#L6647-L6683 The thread fills the data that'll be clone's return value, and trigger the conditional variable. https://github.com/AFLplusplus/qemu-libafl-bridge/blob/99ea52d12369d0bd30717c57e65719a2644b7c68/linux-user/syscall.c#L6544-L6568 When the clone's caller gets unlocked, the info soon gets out of scope. Then if LibAFL hooks are called, it accesses the freed-then-reused stack memory which contains trash.

xdqi commented 8 months ago

The patch solves the problem by not using the freed info->tid. Instead, we get TID when there are hooks to be called.

andreafioraldi commented 8 months ago

Hi, ty you are right