search

subgraph / subgraph-os-issues

Subgraph OS issues repository
73 stars 10 forks source link

wifi triggered kernel panic #129

Open ioerror opened 8 years ago

ioerror commented 8 years ago

I've found a reliable crash for Linux subgraph 4.4.2-grsec-amd64 #1 SMP Sun Feb 21 00:55:03 UTC 2016 x86_64 GNU/Linux - I have a bunch of photographs of kernel panics on tty0 and @special has some packet captures. It looks nice and like pax interferes.

I'll upload data after discussing with the rest of the subgraph security team...

ioerror commented 8 years ago

I'm at a hotel in Thailand with a network named NSAH - every attempt to join the network causes my sgos machine to hard lock with a kernel panic. I'm attaching a packet capture of a sgos machine attempting to join the NSAH network. The capture begins when NetworkManager attempts to join the network and it ends when the laptop panics. The packet capture was created with a second laptop in monitor mode.

ioerror commented 8 years ago

panic is a photograph of the screen at after a panic. I have a few of these - I was able to reproduce the crashes such that each panic started with something resembling PAX: size overflow detected in function skb_headers_offset_update net/core/skbuff.c:974

I have a few other pcaps and I've attached the cleanest with the fewest packets in total (seven packets, I think); the sgos machine has mac address 00:01:02:03:04:05: 0day-9.pcapng.zip

ioerror commented 8 years ago

Spender pointed me to https://forums.grsecurity.net/viewtopic.php?f=3&t=4350

spender-sandbox commented 8 years ago

Actually it's a little different from that post -- to debug it we'd need to see the following info:

prior to the skb_headers_offset_update call in skb_copy_expand, add a printk(KERN_ALERT "newheadroom: %08x oldheadroom: %08x\n", newheadroom, oldheadroom);

then in skb_headers_offset_update, just before the skb->network_header += off line: printk(KERN_ALERT "network_header: %04x\n", skb->network_header);

-Brad