Branch: refs/heads/bbiiggppiigg/fix-proccontrol-exit-uaf
Home: https://github.com/dyninst/dyninst
Commit: b07532e9cf725e6007ab83581fff4b8e623f2579
https://github.com/dyninst/dyninst/commit/b07532e9cf725e6007ab83581fff4b8e623f2579
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/process.C
Log Message:
-----------
proccontrol: fix UAF in infMalloc across the RPC wait
int_process::infMalloc cached raw int_process* in active_mallocs, ran the
inferior-malloc RPCs via waitAndHandleEvents(), then dereferenced those
raw pointers (getPid/setLastError/memory/proc) afterward. The RPC runs
the target, so it can exit and be deleted during the wait, dangling the
raw pointer. The sibling infFree already does this safely (Process::ptr
+ re-derive llproc() + NULL-check); mirror it in infMalloc.
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Commit: 1de59622c9978a1e7fe2d19e11eeedc145b1c180
https://github.com/dyninst/dyninst/commit/1de59622c9978a1e7fe2d19e11eeedc145b1c180
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/process.C
Log Message:
-----------
proccontrol: fix UAF in process create/attach bootstrap
int_process::create and int_process::attach snapshotted raw int_process*
in a set and re-dereferenced them across the waitForAsyncEvent /
waitAndHandleEvents / waitfor_startup calls that drive post_create /
post_attach and startup. A process that exits/crashes during bootstrap
is deleted inside those calls (nulling the wrapper's llproc_), leaving
the raw pointer dangling -- e.g. attach even read proc->pid after
waitfor_startup had already deleted proc.
Hold Process::ptr wrappers and re-derive llproc() after each event call,
skipping any process that was freed. Also fixes a latent infinite loop
in attach's plat_attachThreadsSync loop (an errorstate 'continue' that
never advanced the iterator).
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Commit: 7586d7d376349c500cb329d563ddf45dbec76091
https://github.com/dyninst/dyninst/commit/7586d7d376349c500cb329d563ddf45dbec76091
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/procset.C
Log Message:
-----------
proccontrol: fix UAF in LWPTrackingSet::refreshLWPs
refreshLWPs held raw int_process* in all_procs/change_procs and
re-dereferenced them after waitForAsyncEvent and waitAndHandleEvents; a
process deleted during either wait left the raw pointer dangling. Hold
Process::ptr wrappers and re-derive llproc()/getLWPTracking() after each
wait, skipping any freed process.
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Commit: 0716e13a6dbdf9a47ecea4ec8fb122efc261c02d
https://github.com/dyninst/dyninst/commit/0716e13a6dbdf9a47ecea4ec8fb122efc261c02d
Author: Hsuan-Heng Wu <bbiiggppiigg@xxxxxxxxx>
Date: 2026-07-09 (Thu, 09 Jul 2026)
Changed paths:
M proccontrol/src/process.C
M proccontrol/src/procset.C
Log Message:
-----------
proccontrol: fix UAF in breakpoint install across async waits
addBreakpointWorker cached raw int_process* in bp_installs and called
addBreakpoint_phase2/phase3 on them after two waitForAsyncEvent calls;
sw_breakpoint::create likewise held its int_process* argument across the
memory/result waits. A process that exits during breakpoint installation
is deleted inside those waits, dangling the pointer. Carry Process::ptr
(worker set + its three callers) and re-derive llproc() after each wait,
and in sw_breakpoint::create check the process wrapper's liveness after
each wait, bailing if it exited.
Co-Authored-By: Claude Opus 4.8 <noreply@xxxxxxxxxxxxx>
Compare: https://github.com/dyninst/dyninst/compare/49da9d98a16e...0716e13a6dbd
To unsubscribe from these emails, change your notification settings at https://github.com/dyninst/dyninst/settings/notifications
|