Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: security_socket_connect wrong fd #3951

Merged
merged 1 commit into from
Apr 3, 2024
Merged

fix: security_socket_connect wrong fd #3951

merged 1 commit into from
Apr 3, 2024

Conversation

yanivagman
Copy link
Collaborator

1. Explain what the PR does

The security_scoket_connect event sent the wrong fd number. This was due to using a wrong way to check if the binary is a 32bit binary.

Fix: #3950

2. Explain how to test it

3. Other comments

@yanivagman
fix: security_socket_connect wrong fd
927a63c 
The security_scoket_connect event sent the wrong fd number.
This was due to using a wrong way to check if the binary is a 32bit
binary. Fix this.
@geyslan
Copy link
Member

geyslan commented Apr 3, 2024

Perhaps there's more places to fix, like case SYSCALL_SOCKETCALL:: 5040b00

@yanivagman
Copy link
Collaborator Author

yanivagman commented Apr 3, 2024 •
edited
Loading

Perhaps there's more places to fix, like case SYSCALL_SOCKETCALL:: 5040b00

In all these other places there's the case SYSCALL_SOCKETCALL which should only be called from i386 binaries, so I think there is no problem there (there might be a different problem there though, since I see that it uses args[1] as the file descriptor, while this is actually a void pointer, but this is not related to this fix)

geyslan
geyslan approved these changes Apr 3, 2024
View reviewed changes
Copy link
Member

@geyslan geyslan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@yanivagman yanivagman merged commit 151b9d6 into aquasecurity:main Apr 3, 2024
33 checks passed
@yanivagman yanivagman deleted the fix_security_socket_connect_fd branch April 3, 2024 13:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@geyslan geyslan geyslan approved these changes

Assignees

@yanivagman yanivagman

Labels
area/ebpf kind/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Wrong fd in security socket connect
2 participants
@yanivagman @geyslan