aquasecurity / aquasecurity/tracee

The key `ts` of fd_arg_path_map may be in conflict.

Open
#4,802 1 comment 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

The key `ts` of fd_arg_path_map may be in conflict. If many threads do syscall invoke at the same time, the key of fd_arg_path_map will be conflict, which will lost some fd path.
```
if (f) {
u64 ts = sys->ts;
fd_arg_path_t fd_arg_path = {};
void *file_path = get_path_str(__builtin_preserve_access_index(&f->f_path));

bpf_probe_read_kernel_str(&fd_arg_path.path, sizeof(fd_arg_path.path), file_path);
bpf_map_update_elem(&fd_arg_path_map, &ts, &fd_arg_path, BPF_ANY);
}
}
```

## Output of `tracee version`:

```
Every version, include the latest.
```

## Output of `uname -a`:

```
Linux localhost 5.10.209-android13-4-00013-g2cf4978b8f8c #1 SMP PREEMPT Tue May 28 04:00:35 UTC 2024 aarch64 Toybo
```

## Additional details

Contributor guide

Open the contributing guide

Research direction

The report does not name a source file; start by locating fd_arg_path_map and the syscall invocation path shown in the snippet. Reproduce concurrent invocations on the reported Linux environment and inspect how the timestamp key is generated. Done means concurrent calls no longer overwrite one another's file paths and the relevant regression test passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.