浅析CVE-2015-3636

 

 

0x0 漏洞信息

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3636

 

0x1 漏洞描述

CVE-2015-3636漏洞是Linux kernel的ping套接字上存在的一个Use-After-Free漏洞.

 

0x2 代码分析

 

在调用connect连接用socket(AF_INET,SOCK_DGRAM,IPPROTO_ICMP)创建的套接字对象前,代码如下:

int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
		       int addr_len, int flags)
{
	struct sock *sk = sock->sk;

	if (addr_len < sizeof(uaddr->sa_family))
		return -EINVAL;
	if (uaddr->sa_family == AF_UNSPEC)
		return sk->sk_prot->disconnect(sk, flags);

	if (!inet_sk(sk)->inet_num && inet_autobind(sk))
		return -EAGAIN;
	return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
}

 

当sa_family == AF_UNSPEC的情况下,调用disconnect函数取决于protocol的类型.比如ICMP套接字.

 

i