diff --git a/README.md b/README.md index 9a67c9e9642d138f06c459bf2a56f165111dd05c..1a2edc3514a334b088e768f473165298add47268 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,16 @@ +### CVE-2017-8890 +vuln in inet_csk_clone_lock in net/ipv4/inet_connection_sock.c +- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/inet_connection_sock.c#L674 + +mc_list set in ip_mc_join_group in net/ipv4/igmp.c +- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/igmp.c#L1788 + +freed in sock_close > sock_release > (sock->ops->release) > inet_release in net/ipv4/af_inet.c (found using gdb) +- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/af_inet.c#L427 + +exact free of mc_list somewhow in ip_mc_drop_socket using kfree_rcu +- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/igmp.c#L2297 + ### GDB Commands ``` aarch64-linux-gnu-gdb linux-3.10.105/vmlinux