Closed stoeckmann closed 3 weeks ago
Not sure if coffee has kicked in yet, but we seem to be missing step 2 in the reproducer.
Step 2 involved uncompressing the module. But it's much nicer to see ASAN stepping in instead of having random effects with out of bounds reads on memory-mapped edges.
Forgot to adjust number 3 after removing it and adding it as a note instead.
elf_get_modversion_lengths
Chose this one, adjusted.
Applied, thanks
We have to verify that symbol names are NUL-terminated, i.e. use strnlen instead of strlen, especially before calling streq.
Proof of Concept (ideally, compile with ASAN):
Create a module with an unterminated symbol name
Try to show modversion information
If you do not compile with ASAN, uncompress
poc.ko.zst
sommap
will be called. Most likely you see invalid data or encounter a crash.