4 ms·

It's a double free in bpf. Here's some slides from the author (from last week) with a more in depth explanation: http://crack.bargains/02r0.pdf http://crack.b

It's a double free in bpf. Here's some slides from the author (from last week) with a more in depth explanation: http://crack.bargains/02r0.pdf http://crack.bargains/02r0.pdf

Aissen 8y ago
Much more interesting than the raw code. I'd replace the link if I were a mod.
unwind 8y ago
Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person). I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering. [1] https://www.freebsd.org/cgi/man.cgi?bpf(4) https://www.freebsd.org/cgi/man.cgi?bpf(4)
- brobinson 8y ago
  These also exist in the Linux kernel (bpf/ebpf)
  - 0xad 8y ago
    And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).
- VectorLock 8y ago
  BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.
  - loeg 8y ago
    That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.
- loeg 8y ago
  > I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet). https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 (Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.) As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.

It's a double free in bpf. Here's some slides from the author (from last week) with a more in depth explanation: http://crack.bargains/02r0.pdf http://crack.bargains/02r0.pdf

Aissen 8y ago

Much more interesting than the raw code. I'd replace the link if I were a mod.

unwind 8y ago

Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person). I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering. [1] https://www.freebsd.org/cgi/man.cgi?bpf(4) https://www.freebsd.org/cgi/man.cgi?bpf(4)

brobinson 8y ago
These also exist in the Linux kernel (bpf/ebpf)
- 0xad 8y ago
  And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).
VectorLock 8y ago
BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.
- loeg 8y ago
  That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.
loeg 8y ago
> I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet). https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 (Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.) As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.