Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Socket dataset: Workaround for bogus dereference in kernel 5.x #15771

Merged
merged 4 commits into from
Jan 23, 2020
Merged

Socket dataset: Workaround for bogus dereference in kernel 5.x #15771

merged 4 commits into from
Jan 23, 2020

Commits on Jan 23, 2020

  1. Socket dataset: Workaround for bogus dereference in kernel 5.x 

    This is a tentative workaround for the problems in Auditbeat's
system/socket dataset when run under 5.x kernels.

On older kernels, we could rely on dereferencing a NULL or invalid
pointer returning zeroed memory. However, seems that in the tested 5.x
kernels is not the case. Dereferencing a NULL pointer returns bogus
memory, which causes some wrong codepaths to be taken in a couple of
kprobes defined by the dataset.

This so far seems only to affect udp_sendmsg and udpv6_sendmsg, which
caused it to attribute traffic to bogus IP addresses. In turn this
caused the test-connected-udp system tests to fail.
    @adriansr
    adriansr committed Jan 23, 2020
    Configuration menu
    Copy the full SHA
    d9a5699 View commit details
    Browse the repository at this point in the history

  2. Fix unit tests

    @adriansr
    adriansr committed Jan 23, 2020
    Configuration menu
    Copy the full SHA
    284acaf View commit details
    Browse the repository at this point in the history

  3. Cleanup deref check

    @adriansr
    adriansr committed Jan 23, 2020
    Configuration menu
    Copy the full SHA
    9ae4d67 View commit details
    Browse the repository at this point in the history

  4. Changelog

    @adriansr
    adriansr committed Jan 23, 2020
    Configuration menu
    Copy the full SHA
    830f178 View commit details
    Browse the repository at this point in the history