CINXE.COM

<!DOCTYPE html> <html class='v2' dir='ltr' lang='en' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='http://www.google.com/2005/gml/expr'> <head> <link href='https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css' rel='stylesheet' type='text/css'/> <meta content='width=1100' name='viewport'/> <meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/> <meta content='blogger' name='generator'/> <link href='https://googleprojectzero.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/> <link href='https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html' rel='canonical'/> <link rel="alternate" type="application/atom+xml" title="Project Zero - Atom" href="https://googleprojectzero.blogspot.com/feeds/posts/default" /> <link rel="alternate" type="application/rss+xml" title="Project Zero - RSS" href="https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss" /> <link rel="service.post" type="application/atom+xml" title="Project Zero - Atom" href="https://www.blogger.com/feeds/4838136820032157985/posts/default" /> <link rel="alternate" type="application/atom+xml" title="Project Zero - Atom" href="https://googleprojectzero.blogspot.com/feeds/6481767562526230244/comments/default" />  <link href='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s1200/image71.png' rel='image_src'/> <meta content='https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html' property='og:url'/> <meta content='The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)' property='og:title'/> <meta content=' A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest...' property='og:description'/> <meta content='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/w1200-h630-p-k-no-nu/image71.png' property='og:image'/> <title>Project Zero: The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)</title> <style type='text/css'>@font-face{font-family:'Open Sans';font-style:normal;font-weight:400;font-stretch:normal;font-display:swap;src:url(//fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVY.eot);}</style> <style id='page-skin-1' type='text/css'></style> <style id='template-skin-1' type='text/css'></style> <script type='text/javascript'> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-240546891-1', 'auto', 'blogger'); ga('blogger.send', 'pageview'); </script> <link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4838136820032157985&zx=dd12d16f-47b1-45ec-9a52-9d6602fe5782' media='none' onload='if(media!='all')media='all'' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4838136820032157985&zx=dd12d16f-47b1-45ec-9a52-9d6602fe5782' rel='stylesheet'/></noscript> <meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/> <meta name='google-adsense-platform-domain' content='blogspot.com'/> </head> <body class='loading'> <div class='navbar section' id='navbar' name='Navbar'><div class='widget Navbar' data-version='1' id='Navbar1'><script type="text/javascript"> function setAttributeOnload(object, attribute, val) { if(window.addEventListener) { window.addEventListener('load', function(){ object[attribute] = val; }, false); } else { window.attachEvent('onload', function(){ object[attribute] = val; }); } } </script> <div id="navbar-iframe-container"></div> <script type="text/javascript" src="https://apis.google.com/js/platform.js"></script> <script type="text/javascript"> gapi.load("gapi.iframes:gapi.iframes.style.bubble", function() { if (gapi.iframes && gapi.iframes.getContext) { gapi.iframes.getContext().openChild({ url: 'https://www.blogger.com/navbar/4838136820032157985?po\x3d6481767562526230244\x26origin\x3dhttps://googleprojectzero.blogspot.com', where: document.getElementById("navbar-iframe-container"), id: "navbar-iframe" }); } }); </script><script type="text/javascript"> (function() { var script = document.createElement('script'); script.type = 'text/javascript'; script.src = '//pagead2.googlesyndication.com/pagead/js/google_top_exp.js'; var head = document.getElementsByTagName('head')[0]; if (head) { head.appendChild(script); }})(); </script> </div></div> <div class='body-fauxcolumns'> <div class='fauxcolumn-outer body-fauxcolumn-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <div class='content'> <div class='content-fauxcolumns'> <div class='fauxcolumn-outer content-fauxcolumn-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <div class='content-outer'> <div class='content-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left content-fauxborder-left'> <div class='fauxborder-right content-fauxborder-right'></div> <div class='content-inner'> <header> <div class='header-outer'> <div class='header-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left header-fauxborder-left'> <div class='fauxborder-right header-fauxborder-right'></div> <div class='region-inner header-inner'> <div class='header section' id='header' name='Header'><div class='widget Header' data-version='1' id='Header1'> <div id='header-inner'> <div class='titlewrapper'> <h1 class='title'> <a href='https://googleprojectzero.blogspot.com/'> Project Zero </a> </h1> </div> <div class='descriptionwrapper'> News and updates from the Project Zero team at Google </div> </div> </div></div> </div> </div> <div class='header-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </header> <div class='tabs-outer'> <div class='tabs-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left tabs-fauxborder-left'> <div class='fauxborder-right tabs-fauxborder-right'></div> <div class='region-inner tabs-inner'> <div class='tabs no-items section' id='crosscol' name='Cross-Column'></div> <div class='tabs no-items section' id='crosscol-overflow' name='Cross-Column 2'></div> </div> </div> <div class='tabs-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='main-outer'> <div class='main-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left main-fauxborder-left'> <div class='fauxborder-right main-fauxborder-right'></div> <div class='region-inner main-inner'> <div class='columns fauxcolumns'> <div class='fauxcolumn-outer fauxcolumn-center-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='fauxcolumn-outer fauxcolumn-left-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='fauxcolumn-outer fauxcolumn-right-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div>  <div class='columns-inner'> <div class='column-center-outer'> <div class='column-center-inner'> <div class='main section' id='main' name='Main'><div class='widget Blog' data-version='1' id='Blog1'> <div class='blog-posts hfeed'> <div class="date-outer"> <h2 class='date-header'>Wednesday, August 10, 2022</h2> <div class="date-posts"> <div class='post-outer'> <div class='post hentry uncustomized-post-template' itemprop='blogPost' itemscope='itemscope' itemtype='http://schema.org/BlogPosting'> <meta content='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s1200/image71.png' itemprop='image_url'/> <meta content='4838136820032157985' itemprop='blogId'/> <meta content='6481767562526230244' itemprop='postId'/> <a name='6481767562526230244'></a> <h3 class='post-title entry-title' itemprop='name'> The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I) </h3> <div class='post-header'> <div class='post-header-line-1'></div> </div> <div class='post-body entry-content' id='post-body-6481767562526230244' itemprop='description articleBody'> <style type="text/css">@import url('https://themes.googleusercontent.com/fonts/css?kit=wJuDEFlUsDZt7lpAAPdLm9CoNqneSjGN6FUREF5POP9krml-9Eg4KzR8naUO0aF3kuG_eoWNft1SfWZjF8JeEg');.lst-kix_wm3dnufq67dx-7>li:before{content:"- "}.lst-kix_wm3dnufq67dx-8>li:before{content:"- "}ol.lst-kix_iptxq54yrrnf-3.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-3 0}.lst-kix_u3opzkdcnklc-1>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-1}.lst-kix_wm3dnufq67dx-1>li:before{content:"- "}.lst-kix_iptxq54yrrnf-4>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-4}ol.lst-kix_mfudkcwv2w89-7.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-7 0}.lst-kix_wm3dnufq67dx-0>li:before{content:"- "}.lst-kix_hk8k8itxmlfp-4>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-4}.lst-kix_8chkxhfzc2ds-3>li:before{content:"- "}.lst-kix_8chkxhfzc2ds-5>li:before{content:"- "}.lst-kix_8chkxhfzc2ds-4>li:before{content:"- "}.lst-kix_8chkxhfzc2ds-8>li:before{content:"- "}.lst-kix_8chkxhfzc2ds-7>li:before{content:"- "}.lst-kix_8chkxhfzc2ds-6>li:before{content:"- "}ol.lst-kix_58ja23nrczhl-0{list-style-type:none}ol.lst-kix_51hgl6mwb3et-2.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-2 0}ol.lst-kix_58ja23nrczhl-3{list-style-type:none}ol.lst-kix_58ja23nrczhl-4{list-style-type:none}ol.lst-kix_58ja23nrczhl-1{list-style-type:none}ol.lst-kix_58ja23nrczhl-2{list-style-type:none}ol.lst-kix_58ja23nrczhl-7{list-style-type:none}ol.lst-kix_58ja23nrczhl-8{list-style-type:none}ol.lst-kix_58ja23nrczhl-5{list-style-type:none}.lst-kix_58ja23nrczhl-4>li{counter-increment:lst-ctn-kix_58ja23nrczhl-4}ol.lst-kix_58ja23nrczhl-6{list-style-type:none}ol.lst-kix_7y90gfloiotx-8.start{counter-reset:lst-ctn-kix_7y90gfloiotx-8 0}.lst-kix_5yi4tofw6s0z-1>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-1}.lst-kix_51hgl6mwb3et-0>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-0,decimal) ". "}.lst-kix_51hgl6mwb3et-1>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-1,lower-latin) ". "}.lst-kix_51hgl6mwb3et-2>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-2,lower-roman) ". "}.lst-kix_5oipgjcxugcr-0>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-0}ol.lst-kix_j5vmamheymgq-4.start{counter-reset:lst-ctn-kix_j5vmamheymgq-4 0}.lst-kix_51hgl6mwb3et-3>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-3,decimal) ". "}ol.lst-kix_8mkn8rg9im4a-0.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-0 0}.lst-kix_51hgl6mwb3et-4>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-4,lower-latin) ". "}.lst-kix_51hgl6mwb3et-6>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-6,decimal) ". "}.lst-kix_51hgl6mwb3et-5>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-5,lower-roman) ". "}.lst-kix_whw4pjgxp3w1-2>li:before{content:"- "}.lst-kix_hk8k8itxmlfp-0>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-0,decimal) ". "}.lst-kix_51hgl6mwb3et-8>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-8,lower-roman) ". "}.lst-kix_whw4pjgxp3w1-1>li:before{content:"- "}.lst-kix_51hgl6mwb3et-7>li:before{content:"" counter(lst-ctn-kix_51hgl6mwb3et-7,lower-latin) ". "}.lst-kix_whw4pjgxp3w1-0>li:before{content:"- "}ol.lst-kix_mfudkcwv2w89-2.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-2 0}.lst-kix_hk8k8itxmlfp-3>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-3,decimal) ". "}.lst-kix_hk8k8itxmlfp-2>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-2,lower-roman) ". "}.lst-kix_hk8k8itxmlfp-4>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-4,lower-latin) ". "}.lst-kix_hk8k8itxmlfp-1>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-1,lower-latin) ". "}.lst-kix_hk8k8itxmlfp-5>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-5,lower-roman) ". "}ul.lst-kix_9gryrzygx46m-6{list-style-type:none}ul.lst-kix_9gryrzygx46m-5{list-style-type:none}ul.lst-kix_9gryrzygx46m-4{list-style-type:none}ul.lst-kix_9gryrzygx46m-3{list-style-type:none}ul.lst-kix_9gryrzygx46m-8{list-style-type:none}ul.lst-kix_9gryrzygx46m-7{list-style-type:none}.lst-kix_5yi4tofw6s0z-8>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-8}.lst-kix_wm3dnufq67dx-2>li:before{content:"- "}ol.lst-kix_5yi4tofw6s0z-4.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-4 0}.lst-kix_wm3dnufq67dx-3>li:before{content:"- "}.lst-kix_wm3dnufq67dx-4>li:before{content:"- "}ol.lst-kix_iptxq54yrrnf-8.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-8 0}ol.lst-kix_7y90gfloiotx-3.start{counter-reset:lst-ctn-kix_7y90gfloiotx-3 0}.lst-kix_hk8k8itxmlfp-7>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-7,lower-latin) ". "}.lst-kix_wm3dnufq67dx-5>li:before{content:"- "}.lst-kix_wm3dnufq67dx-6>li:before{content:"- "}.lst-kix_hk8k8itxmlfp-6>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-6,decimal) ". "}.lst-kix_hk8k8itxmlfp-8>li:before{content:"" counter(lst-ctn-kix_hk8k8itxmlfp-8,lower-roman) ". "}ol.lst-kix_58ja23nrczhl-4.start{counter-reset:lst-ctn-kix_58ja23nrczhl-4 0}ul.lst-kix_wm3dnufq67dx-0{list-style-type:none}.lst-kix_yjo4cwnqbjp0-2>li:before{content:"- "}ul.lst-kix_wm3dnufq67dx-2{list-style-type:none}ul.lst-kix_wm3dnufq67dx-1{list-style-type:none}.lst-kix_yjo4cwnqbjp0-0>li:before{content:"- "}ul.lst-kix_wm3dnufq67dx-8{list-style-type:none}ul.lst-kix_wm3dnufq67dx-7{list-style-type:none}ul.lst-kix_wm3dnufq67dx-4{list-style-type:none}ul.lst-kix_9gryrzygx46m-2{list-style-type:none}ul.lst-kix_wm3dnufq67dx-3{list-style-type:none}ul.lst-kix_9gryrzygx46m-1{list-style-type:none}ul.lst-kix_wm3dnufq67dx-6{list-style-type:none}ul.lst-kix_9gryrzygx46m-0{list-style-type:none}ul.lst-kix_wm3dnufq67dx-5{list-style-type:none}.lst-kix_yjo4cwnqbjp0-6>li:before{content:"- "}.lst-kix_6l3lpr6ytz51-0>li:before{content:"- "}.lst-kix_yjo4cwnqbjp0-4>li:before{content:"- "}.lst-kix_whw4pjgxp3w1-6>li:before{content:"- "}.lst-kix_j5vmamheymgq-3>li{counter-increment:lst-ctn-kix_j5vmamheymgq-3}.lst-kix_7y90gfloiotx-7>li{counter-increment:lst-ctn-kix_7y90gfloiotx-7}.lst-kix_9prd8pa3o8y7-6>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-6}ol.lst-kix_9prd8pa3o8y7-7.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-7 0}.lst-kix_whw4pjgxp3w1-4>li:before{content:"- "}ol.lst-kix_u3opzkdcnklc-8.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-8 0}.lst-kix_whw4pjgxp3w1-8>li:before{content:"- "}ol.lst-kix_51hgl6mwb3et-7.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-7 0}ol.lst-kix_hk8k8itxmlfp-7.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-7 0}ol.lst-kix_p4ttii5g8cnl-7.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-7 0}ol.lst-kix_5oipgjcxugcr-8.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-8 0}.lst-kix_j5vmamheymgq-7>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-7,lower-latin) ". "}.lst-kix_9prd8pa3o8y7-5>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-5}.lst-kix_8chkxhfzc2ds-1>li:before{content:"- "}.lst-kix_u3opzkdcnklc-8>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-8}.lst-kix_6l3lpr6ytz51-4>li:before{content:"- "}.lst-kix_6l3lpr6ytz51-6>li:before{content:"- "}.lst-kix_j5vmamheymgq-5>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-5,lower-roman) ". "}.lst-kix_6l3lpr6ytz51-2>li:before{content:"- "}.lst-kix_5oipgjcxugcr-8>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-8}.lst-kix_j5vmamheymgq-1>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-1,lower-latin) ". "}.lst-kix_j5vmamheymgq-3>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-3,decimal) ". "}.lst-kix_6l3lpr6ytz51-8>li:before{content:"- "}.lst-kix_7y90gfloiotx-6>li{counter-increment:lst-ctn-kix_7y90gfloiotx-6}.lst-kix_iptxq54yrrnf-5>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-5}ol.lst-kix_hk8k8itxmlfp-8.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-8 0}.lst-kix_hk8k8itxmlfp-5>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-5}ol.lst-kix_p4ttii5g8cnl-6.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-6 0}.lst-kix_mfudkcwv2w89-1>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-1}.lst-kix_58ja23nrczhl-3>li{counter-increment:lst-ctn-kix_58ja23nrczhl-3}.lst-kix_hk8k8itxmlfp-3>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-3}.lst-kix_u3opzkdcnklc-4>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-4,lower-latin) ". "}.lst-kix_u3opzkdcnklc-8>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-8,lower-roman) ". "}.lst-kix_u3opzkdcnklc-3>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-3,decimal) ". "}.lst-kix_u3opzkdcnklc-7>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-7,lower-latin) ". "}.lst-kix_iptxq54yrrnf-3>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-3}ol.lst-kix_p4ttii5g8cnl-1.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-1 0}ol.lst-kix_j5vmamheymgq-8.start{counter-reset:lst-ctn-kix_j5vmamheymgq-8 0}ul.lst-kix_h1p96gz9lzq4-0{list-style-type:none}ul.lst-kix_h1p96gz9lzq4-1{list-style-type:none}.lst-kix_u3opzkdcnklc-0>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-0,decimal) ". "}ul.lst-kix_h1p96gz9lzq4-4{list-style-type:none}ul.lst-kix_h1p96gz9lzq4-5{list-style-type:none}ul.lst-kix_h1p96gz9lzq4-2{list-style-type:none}ul.lst-kix_h1p96gz9lzq4-3{list-style-type:none}ul.lst-kix_h1p96gz9lzq4-8{list-style-type:none}.lst-kix_mfudkcwv2w89-3>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-3}ul.lst-kix_h1p96gz9lzq4-6{list-style-type:none}ul.lst-kix_h1p96gz9lzq4-7{list-style-type:none}.lst-kix_3a2g7o19wgb3-2>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-2}.lst-kix_p4ttii5g8cnl-5>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-5}.lst-kix_5oipgjcxugcr-1>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-1}.lst-kix_3a2g7o19wgb3-4>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-4}ol.lst-kix_j5vmamheymgq-3.start{counter-reset:lst-ctn-kix_j5vmamheymgq-3 0}ol.lst-kix_u3opzkdcnklc-7.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-7 0}.lst-kix_yjo4cwnqbjp0-8>li:before{content:"- "}ol.lst-kix_9prd8pa3o8y7-6.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-6 0}.lst-kix_g3pd9wzbzpzz-3>li:before{content:"- "}.lst-kix_g3pd9wzbzpzz-7>li:before{content:"- "}ol.lst-kix_p4ttii5g8cnl-2.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-2 0}.lst-kix_yjo4cwnqbjp0-1>li:before{content:"- "}ol.lst-kix_iptxq54yrrnf-7.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-7 0}.lst-kix_yjo4cwnqbjp0-5>li:before{content:"- "}.lst-kix_yn2ql2u2egdg-0>li:before{content:"- "}ol.lst-kix_51hgl6mwb3et-1.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-1 0}.lst-kix_dqkfvt9lb2wy-1>li:before{content:"- "}ol.lst-kix_iptxq54yrrnf-4.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-4 0}.lst-kix_whw4pjgxp3w1-5>li:before{content:"- "}.lst-kix_51hgl6mwb3et-2>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-2}.lst-kix_yn2ql2u2egdg-8>li:before{content:"- "}ol.lst-kix_u3opzkdcnklc-2.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-2 0}.lst-kix_mfudkcwv2w89-6>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-6,decimal) ". "}ol.lst-kix_9prd8pa3o8y7-1.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-1 0}.lst-kix_dqkfvt9lb2wy-5>li:before{content:"- "}.lst-kix_yn2ql2u2egdg-4>li:before{content:"- "}.lst-kix_mfudkcwv2w89-2>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-2,lower-roman) ". "}.lst-kix_5oipgjcxugcr-6>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-6,decimal) ". "}.lst-kix_3a2g7o19wgb3-7>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-7,lower-latin) ". "}.lst-kix_5oipgjcxugcr-2>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-2,lower-roman) ". "}.lst-kix_yzib59bcdnhj-4>li:before{content:"- "}.lst-kix_iptxq54yrrnf-4>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-4,lower-latin) ". "}.lst-kix_j5vmamheymgq-1>li{counter-increment:lst-ctn-kix_j5vmamheymgq-1}ol.lst-kix_u3opzkdcnklc-4.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-4 0}.lst-kix_8chkxhfzc2ds-0>li:before{content:"- "}.lst-kix_3a2g7o19wgb3-3>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-3,decimal) ". "}.lst-kix_iptxq54yrrnf-8>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-8,lower-roman) ". "}.lst-kix_j5vmamheymgq-8>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-8,lower-roman) ". "}.lst-kix_mfudkcwv2w89-8>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-8}.lst-kix_yzib59bcdnhj-0>li:before{content:"- "}.lst-kix_8mkn8rg9im4a-2>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-2}.lst-kix_h1p96gz9lzq4-0>li:before{content:"- "}.lst-kix_9prd8pa3o8y7-2>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-2,lower-roman) ". "}.lst-kix_9prd8pa3o8y7-6>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-6,decimal) ". "}.lst-kix_h1p96gz9lzq4-4>li:before{content:"- "}ol.lst-kix_9prd8pa3o8y7-2.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-2 0}.lst-kix_j5vmamheymgq-4>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-4,lower-latin) ". "}.lst-kix_6l3lpr6ytz51-3>li:before{content:"- "}.lst-kix_h1p96gz9lzq4-8>li:before{content:"- "}ol.lst-kix_u3opzkdcnklc-3.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-3 0}.lst-kix_p4ttii5g8cnl-7>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-7}.lst-kix_yzib59bcdnhj-8>li:before{content:"- "}.lst-kix_j5vmamheymgq-0>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-0,decimal) ". "}.lst-kix_6l3lpr6ytz51-7>li:before{content:"- "}ol.lst-kix_5yi4tofw6s0z-8{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-7{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-6{list-style-type:none}.lst-kix_58ja23nrczhl-2>li{counter-increment:lst-ctn-kix_58ja23nrczhl-2}ol.lst-kix_5yi4tofw6s0z-5{list-style-type:none}.lst-kix_7y90gfloiotx-1>li{counter-increment:lst-ctn-kix_7y90gfloiotx-1}ol.lst-kix_3a2g7o19wgb3-1.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-1 0}.lst-kix_iptxq54yrrnf-6>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-6}.lst-kix_8mkn8rg9im4a-4>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-4}ol.lst-kix_51hgl6mwb3et-8.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-8 0}ol.lst-kix_7y90gfloiotx-2.start{counter-reset:lst-ctn-kix_7y90gfloiotx-2 0}.lst-kix_iptxq54yrrnf-2>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-2,lower-roman) ". "}.lst-kix_u3opzkdcnklc-3>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-3}ul.lst-kix_yn2ql2u2egdg-6{list-style-type:none}ul.lst-kix_yn2ql2u2egdg-5{list-style-type:none}ul.lst-kix_yn2ql2u2egdg-8{list-style-type:none}ul.lst-kix_yn2ql2u2egdg-7{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-1.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-1 0}.lst-kix_p4ttii5g8cnl-0>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-0,decimal) ". "}.lst-kix_p4ttii5g8cnl-3>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-3,decimal) ". "}.lst-kix_iptxq54yrrnf-2>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-2}.lst-kix_j5vmamheymgq-8>li{counter-increment:lst-ctn-kix_j5vmamheymgq-8}.lst-kix_p4ttii5g8cnl-5>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-5,lower-roman) ". "}.lst-kix_p4ttii5g8cnl-6>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-6,decimal) ". "}ol.lst-kix_51hgl6mwb3et-3.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-3 0}.lst-kix_58ja23nrczhl-6>li{counter-increment:lst-ctn-kix_58ja23nrczhl-6}.lst-kix_7y90gfloiotx-8>li{counter-increment:lst-ctn-kix_7y90gfloiotx-8}ol.lst-kix_3a2g7o19wgb3-6.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-6 0}ol.lst-kix_58ja23nrczhl-5.start{counter-reset:lst-ctn-kix_58ja23nrczhl-5 0}ol.lst-kix_p4ttii5g8cnl-3.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-3 0}ol.lst-kix_5yi4tofw6s0z-0{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-6.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-6 0}.lst-kix_58ja23nrczhl-5>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-5,lower-roman) ". "}.lst-kix_p4ttii5g8cnl-8>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-8,lower-roman) ". "}ol.lst-kix_5yi4tofw6s0z-4{list-style-type:none}.lst-kix_58ja23nrczhl-4>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-4,lower-latin) ". "}ol.lst-kix_5yi4tofw6s0z-3{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-2{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-1{list-style-type:none}.lst-kix_58ja23nrczhl-2>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-2,lower-roman) ". "}.lst-kix_g3pd9wzbzpzz-6>li:before{content:"- "}ol.lst-kix_3a2g7o19wgb3-8.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-8 0}ol.lst-kix_8mkn8rg9im4a-8.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-8 0}.lst-kix_yn2ql2u2egdg-1>li:before{content:"- "}.lst-kix_58ja23nrczhl-7>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-7,lower-latin) ". "}ol.lst-kix_7y90gfloiotx-1{list-style-type:none}ol.lst-kix_7y90gfloiotx-0{list-style-type:none}.lst-kix_g3pd9wzbzpzz-4>li:before{content:"- "}ol.lst-kix_7y90gfloiotx-4.start{counter-reset:lst-ctn-kix_7y90gfloiotx-4 0}.lst-kix_dqkfvt9lb2wy-0>li:before{content:"- "}ol.lst-kix_7y90gfloiotx-7{list-style-type:none}ol.lst-kix_7y90gfloiotx-6{list-style-type:none}ol.lst-kix_7y90gfloiotx-8{list-style-type:none}ol.lst-kix_7y90gfloiotx-3{list-style-type:none}ol.lst-kix_7y90gfloiotx-2{list-style-type:none}ol.lst-kix_7y90gfloiotx-5{list-style-type:none}ol.lst-kix_7y90gfloiotx-4{list-style-type:none}.lst-kix_k47gmg94hbw2-5>li:before{content:"- "}ol.lst-kix_p4ttii5g8cnl-5.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-5 0}.lst-kix_mfudkcwv2w89-7>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-7,lower-latin) ". "}.lst-kix_yn2ql2u2egdg-3>li:before{content:"- "}ol.lst-kix_hk8k8itxmlfp-4.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-4 0}.lst-kix_mfudkcwv2w89-1>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-1,lower-latin) ". "}.lst-kix_dqkfvt9lb2wy-6>li:before{content:"- "}ol.lst-kix_p4ttii5g8cnl-8.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-8 0}.lst-kix_k47gmg94hbw2-3>li:before{content:"- "}.lst-kix_dqkfvt9lb2wy-8>li:before{content:"- "}.lst-kix_3a2g7o19wgb3-8>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-8,lower-roman) ". "}.lst-kix_5oipgjcxugcr-5>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-5,lower-roman) ". "}ol.lst-kix_58ja23nrczhl-8.start{counter-reset:lst-ctn-kix_58ja23nrczhl-8 0}.lst-kix_9gryrzygx46m-1>li:before{content:"- "}ul.lst-kix_yn2ql2u2egdg-2{list-style-type:none}ul.lst-kix_yn2ql2u2egdg-1{list-style-type:none}.lst-kix_5oipgjcxugcr-3>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-3,decimal) ". "}ul.lst-kix_yn2ql2u2egdg-4{list-style-type:none}ul.lst-kix_yn2ql2u2egdg-3{list-style-type:none}.lst-kix_58ja23nrczhl-5>li{counter-increment:lst-ctn-kix_58ja23nrczhl-5}ul.lst-kix_yn2ql2u2egdg-0{list-style-type:none}.lst-kix_9gryrzygx46m-7>li:before{content:"- "}.lst-kix_3a2g7o19wgb3-0>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-0,decimal) ". "}.lst-kix_iptxq54yrrnf-5>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-5,lower-roman) ". "}.lst-kix_iptxq54yrrnf-7>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-7,lower-latin) ". "}.lst-kix_3a2g7o19wgb3-2>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-2,lower-roman) ". "}.lst-kix_9prd8pa3o8y7-3>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-3,decimal) ". "}ol.lst-kix_51hgl6mwb3et-6.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-6 0}.lst-kix_zcvcgbx5ju56-1>li:before{content:"- "}.lst-kix_5oipgjcxugcr-2>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-2}ol.lst-kix_7y90gfloiotx-7.start{counter-reset:lst-ctn-kix_7y90gfloiotx-7 0}.lst-kix_5yi4tofw6s0z-3>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-3}ol.lst-kix_8mkn8rg9im4a-7{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-6{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-8{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-3{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-2{list-style-type:none}ol.lst-kix_58ja23nrczhl-7.start{counter-reset:lst-ctn-kix_58ja23nrczhl-7 0}.lst-kix_zcvcgbx5ju56-7>li:before{content:"- "}ol.lst-kix_8mkn8rg9im4a-5{list-style-type:none}ol.lst-kix_8mkn8rg9im4a-4{list-style-type:none}ul.lst-kix_t1ae57uxlfl0-3{list-style-type:none}ul.lst-kix_t1ae57uxlfl0-4{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-6.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-6 0}ol.lst-kix_8mkn8rg9im4a-1{list-style-type:none}ul.lst-kix_t1ae57uxlfl0-1{list-style-type:none}.lst-kix_h1p96gz9lzq4-7>li:before{content:"- "}ol.lst-kix_8mkn8rg9im4a-0{list-style-type:none}ul.lst-kix_t1ae57uxlfl0-2{list-style-type:none}.lst-kix_yzib59bcdnhj-5>li:before{content:"- "}ul.lst-kix_t1ae57uxlfl0-0{list-style-type:none}.lst-kix_h1p96gz9lzq4-5>li:before{content:"- "}ul.lst-kix_t1ae57uxlfl0-7{list-style-type:none}.lst-kix_9prd8pa3o8y7-5>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-5,lower-roman) ". "}ul.lst-kix_t1ae57uxlfl0-8{list-style-type:none}.lst-kix_yzib59bcdnhj-7>li:before{content:"- "}.lst-kix_51hgl6mwb3et-4>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-4}.lst-kix_p4ttii5g8cnl-4>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-4}ul.lst-kix_t1ae57uxlfl0-5{list-style-type:none}ul.lst-kix_t1ae57uxlfl0-6{list-style-type:none}.lst-kix_7y90gfloiotx-0>li{counter-increment:lst-ctn-kix_7y90gfloiotx-0}.lst-kix_5yi4tofw6s0z-0>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-0,decimal) ". "}ol.lst-kix_hk8k8itxmlfp-2.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-2 0}.lst-kix_u3opzkdcnklc-6>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-6,decimal) ". "}.lst-kix_f96hgc2s4b68-6>li:before{content:"- "}.lst-kix_f96hgc2s4b68-3>li:before{content:"- "}.lst-kix_51hgl6mwb3et-8>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-8}ol.lst-kix_8mkn8rg9im4a-4.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-4 0}ol.lst-kix_58ja23nrczhl-2.start{counter-reset:lst-ctn-kix_58ja23nrczhl-2 0}.lst-kix_5yi4tofw6s0z-8>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-8,lower-roman) ". "}ol.lst-kix_3a2g7o19wgb3-4.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-4 0}ol.lst-kix_7y90gfloiotx-5.start{counter-reset:lst-ctn-kix_7y90gfloiotx-5 0}.lst-kix_5yi4tofw6s0z-3>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-3,decimal) ". "}.lst-kix_u3opzkdcnklc-1>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-1,lower-latin) ". "}.lst-kix_u3opzkdcnklc-0>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-0}ol.lst-kix_hk8k8itxmlfp-3.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-3 0}ol.lst-kix_p4ttii5g8cnl-8{list-style-type:none}.lst-kix_7y90gfloiotx-4>li{counter-increment:lst-ctn-kix_7y90gfloiotx-4}.lst-kix_t1ae57uxlfl0-6>li:before{content:"- "}.lst-kix_u3opzkdcnklc-7>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-7}ol.lst-kix_3a2g7o19wgb3-5.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-5 0}.lst-kix_j5vmamheymgq-5>li{counter-increment:lst-ctn-kix_j5vmamheymgq-5}.lst-kix_j5vmamheymgq-2>li{counter-increment:lst-ctn-kix_j5vmamheymgq-2}.lst-kix_t1ae57uxlfl0-1>li:before{content:"- "}ol.lst-kix_58ja23nrczhl-3.start{counter-reset:lst-ctn-kix_58ja23nrczhl-3 0}ol.lst-kix_7y90gfloiotx-1.start{counter-reset:lst-ctn-kix_7y90gfloiotx-1 0}.lst-kix_p4ttii5g8cnl-8>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-8}.lst-kix_g3pd9wzbzpzz-1>li:before{content:"- "}.lst-kix_aj3gpabmyk88-3>li:before{content:"- "}ol.lst-kix_58ja23nrczhl-0.start{counter-reset:lst-ctn-kix_58ja23nrczhl-0 0}.lst-kix_dqkfvt9lb2wy-3>li:before{content:"- "}ol.lst-kix_8mkn8rg9im4a-5.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-5 0}.lst-kix_6l3lpr6ytz51-1>li:before{content:"- "}.lst-kix_yjo4cwnqbjp0-3>li:before{content:"- "}.lst-kix_k47gmg94hbw2-8>li:before{content:"- "}.lst-kix_8mkn8rg9im4a-1>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-1}.lst-kix_whw4pjgxp3w1-3>li:before{content:"- "}ol.lst-kix_p4ttii5g8cnl-3{list-style-type:none}ol.lst-kix_p4ttii5g8cnl-2{list-style-type:none}ol.lst-kix_p4ttii5g8cnl-1{list-style-type:none}.lst-kix_k47gmg94hbw2-0>li:before{content:"- "}ol.lst-kix_p4ttii5g8cnl-0{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-0.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-0 0}.lst-kix_5oipgjcxugcr-0>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-0,decimal) ". "}ol.lst-kix_p4ttii5g8cnl-7{list-style-type:none}ol.lst-kix_p4ttii5g8cnl-6{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-1.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-1 0}ol.lst-kix_p4ttii5g8cnl-5{list-style-type:none}ol.lst-kix_p4ttii5g8cnl-4{list-style-type:none}.lst-kix_mfudkcwv2w89-4>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-4,lower-latin) ". "}.lst-kix_5yi4tofw6s0z-7>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-7}.lst-kix_yn2ql2u2egdg-6>li:before{content:"- "}.lst-kix_8mkn8rg9im4a-8>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-8}ol.lst-kix_j5vmamheymgq-6{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-3.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-3 0}ol.lst-kix_j5vmamheymgq-7{list-style-type:none}ol.lst-kix_j5vmamheymgq-8{list-style-type:none}.lst-kix_9gryrzygx46m-4>li:before{content:"- "}ol.lst-kix_8mkn8rg9im4a-3.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-3 0}.lst-kix_5oipgjcxugcr-8>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-8,lower-roman) ". "}ol.lst-kix_j5vmamheymgq-0{list-style-type:none}ol.lst-kix_j5vmamheymgq-1{list-style-type:none}ol.lst-kix_j5vmamheymgq-2{list-style-type:none}ol.lst-kix_j5vmamheymgq-3{list-style-type:none}.lst-kix_3a2g7o19wgb3-5>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-5,lower-roman) ". "}ol.lst-kix_j5vmamheymgq-4{list-style-type:none}ol.lst-kix_j5vmamheymgq-5{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-0.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-0 0}.lst-kix_yzib59bcdnhj-2>li:before{content:"- "}.lst-kix_3a2g7o19wgb3-3>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-3}.lst-kix_8chkxhfzc2ds-2>li:before{content:"- "}.lst-kix_mfudkcwv2w89-2>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-2}.lst-kix_1m9wqzg4mvqt-1>li:before{content:"- "}ol.lst-kix_8mkn8rg9im4a-2.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-2 0}.lst-kix_5oipgjcxugcr-5>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-5}.lst-kix_j5vmamheymgq-6>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-6,decimal) ". "}ul.lst-kix_8chkxhfzc2ds-4{list-style-type:none}.lst-kix_9prd8pa3o8y7-0>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-0,decimal) ". "}.lst-kix_9prd8pa3o8y7-8>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-8,lower-roman) ". "}ul.lst-kix_8chkxhfzc2ds-3{list-style-type:none}ul.lst-kix_8chkxhfzc2ds-2{list-style-type:none}ul.lst-kix_8chkxhfzc2ds-1{list-style-type:none}.lst-kix_h1p96gz9lzq4-2>li:before{content:"- "}ul.lst-kix_8chkxhfzc2ds-8{list-style-type:none}ul.lst-kix_8chkxhfzc2ds-7{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ul.lst-kix_8chkxhfzc2ds-6{list-style-type:none}.lst-kix_5yi4tofw6s0z-0>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-0}ul.lst-kix_8chkxhfzc2ds-5{list-style-type:none}.lst-kix_51hgl6mwb3et-1>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-1}.lst-kix_p4ttii5g8cnl-1>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-1}.lst-kix_7y90gfloiotx-2>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-2,lower-roman) ". "}ul.lst-kix_8chkxhfzc2ds-0{list-style-type:none}ol.lst-kix_58ja23nrczhl-1.start{counter-reset:lst-ctn-kix_58ja23nrczhl-1 0}.lst-kix_8mkn8rg9im4a-5>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-5,lower-roman) ". "}ol.lst-kix_7y90gfloiotx-0.start{counter-reset:lst-ctn-kix_7y90gfloiotx-0 0}ol.lst-kix_3a2g7o19wgb3-2.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-2 0}.lst-kix_zcvcgbx5ju56-4>li:before{content:"- "}.lst-kix_p4ttii5g8cnl-2>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-2}ol.lst-kix_hk8k8itxmlfp-5.start{counter-reset:lst-ctn-kix_hk8k8itxmlfp-5 0}.lst-kix_5oipgjcxugcr-4>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-4}.lst-kix_9prd8pa3o8y7-2>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-2}ol.lst-kix_3a2g7o19wgb3-6{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-5{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-4{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-3{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-8{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-7{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-7.start{counter-reset:lst-ctn-kix_3a2g7o19wgb3-7 0}ol.lst-kix_p4ttii5g8cnl-4.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-4 0}.lst-kix_iptxq54yrrnf-8>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-8}.lst-kix_5yi4tofw6s0z-5>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-5}.lst-kix_58ja23nrczhl-0>li{counter-increment:lst-ctn-kix_58ja23nrczhl-0}ol.lst-kix_8mkn8rg9im4a-7.start{counter-reset:lst-ctn-kix_8mkn8rg9im4a-7 0}.lst-kix_hk8k8itxmlfp-8>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-8}ul.lst-kix_zcvcgbx5ju56-1{list-style-type:none}ul.lst-kix_zcvcgbx5ju56-2{list-style-type:none}ul.lst-kix_zcvcgbx5ju56-0{list-style-type:none}ul.lst-kix_zcvcgbx5ju56-5{list-style-type:none}.lst-kix_8mkn8rg9im4a-6>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-6}ul.lst-kix_zcvcgbx5ju56-6{list-style-type:none}ul.lst-kix_zcvcgbx5ju56-3{list-style-type:none}ul.lst-kix_zcvcgbx5ju56-4{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-7.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-7 0}.lst-kix_aj3gpabmyk88-8>li:before{content:"- "}ol.lst-kix_5oipgjcxugcr-6.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-6 0}.lst-kix_aj3gpabmyk88-4>li:before{content:"- "}.lst-kix_mfudkcwv2w89-6>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-6}.lst-kix_aj3gpabmyk88-2>li:before{content:"- "}.lst-kix_8mkn8rg9im4a-8>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-8,lower-roman) ". "}.lst-kix_1m9wqzg4mvqt-8>li:before{content:"- "}.lst-kix_aj3gpabmyk88-0>li:before{content:"- "}.lst-kix_mfudkcwv2w89-5>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-5}ol.lst-kix_51hgl6mwb3et-8{list-style-type:none}.lst-kix_hk8k8itxmlfp-0>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-0}.lst-kix_iptxq54yrrnf-0>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-0}.lst-kix_51hgl6mwb3et-5>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-5}ol.lst-kix_58ja23nrczhl-6.start{counter-reset:lst-ctn-kix_58ja23nrczhl-6 0}ol.lst-kix_j5vmamheymgq-1.start{counter-reset:lst-ctn-kix_j5vmamheymgq-1 0}ol.lst-kix_51hgl6mwb3et-6{list-style-type:none}ol.lst-kix_51hgl6mwb3et-7{list-style-type:none}ol.lst-kix_51hgl6mwb3et-4{list-style-type:none}ol.lst-kix_51hgl6mwb3et-5{list-style-type:none}ol.lst-kix_51hgl6mwb3et-2{list-style-type:none}ol.lst-kix_51hgl6mwb3et-3{list-style-type:none}ol.lst-kix_51hgl6mwb3et-0{list-style-type:none}ol.lst-kix_51hgl6mwb3et-1{list-style-type:none}.lst-kix_hk8k8itxmlfp-7>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-7}ol.lst-kix_7y90gfloiotx-6.start{counter-reset:lst-ctn-kix_7y90gfloiotx-6 0}.lst-kix_iptxq54yrrnf-7>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-7}.lst-kix_iptxq54yrrnf-1>li{counter-increment:lst-ctn-kix_iptxq54yrrnf-1}ol.lst-kix_3a2g7o19wgb3-2{list-style-type:none}.lst-kix_hk8k8itxmlfp-1>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-1}ol.lst-kix_3a2g7o19wgb3-1{list-style-type:none}ol.lst-kix_3a2g7o19wgb3-0{list-style-type:none}.lst-kix_1m9wqzg4mvqt-0>li:before{content:"- "}.lst-kix_8mkn8rg9im4a-0>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-0,decimal) ". "}.lst-kix_1m9wqzg4mvqt-4>li:before{content:"- "}.lst-kix_8mkn8rg9im4a-2>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-2,lower-roman) ". "}ol.lst-kix_mfudkcwv2w89-5.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-5 0}.lst-kix_1m9wqzg4mvqt-6>li:before{content:"- "}.lst-kix_7y90gfloiotx-7>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-7,lower-latin) ". "}.lst-kix_3a2g7o19wgb3-6>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-6}.lst-kix_8mkn8rg9im4a-6>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-6,decimal) ". "}.lst-kix_7y90gfloiotx-1>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-1,lower-latin) ". "}.lst-kix_7y90gfloiotx-5>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-5,lower-roman) ". "}.lst-kix_8mkn8rg9im4a-4>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-4,lower-latin) ". "}.lst-kix_1m9wqzg4mvqt-2>li:before{content:"- "}.lst-kix_aj3gpabmyk88-6>li:before{content:"- "}.lst-kix_7y90gfloiotx-3>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-3,decimal) ". "}ul.lst-kix_6l3lpr6ytz51-8{list-style-type:none}.lst-kix_8mkn8rg9im4a-5>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-5}ol.lst-kix_mfudkcwv2w89-4.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-4 0}ul.lst-kix_6l3lpr6ytz51-7{list-style-type:none}ul.lst-kix_6l3lpr6ytz51-4{list-style-type:none}ol.lst-kix_u3opzkdcnklc-6.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-6 0}ul.lst-kix_6l3lpr6ytz51-3{list-style-type:none}ul.lst-kix_6l3lpr6ytz51-6{list-style-type:none}ul.lst-kix_6l3lpr6ytz51-5{list-style-type:none}ul.lst-kix_6l3lpr6ytz51-0{list-style-type:none}ul.lst-kix_6l3lpr6ytz51-2{list-style-type:none}ol.lst-kix_u3opzkdcnklc-8{list-style-type:none}ul.lst-kix_6l3lpr6ytz51-1{list-style-type:none}ol.lst-kix_u3opzkdcnklc-7{list-style-type:none}ol.lst-kix_u3opzkdcnklc-6{list-style-type:none}ol.lst-kix_u3opzkdcnklc-5{list-style-type:none}ol.lst-kix_u3opzkdcnklc-4{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-0.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-0 0}ol.lst-kix_j5vmamheymgq-2.start{counter-reset:lst-ctn-kix_j5vmamheymgq-2 0}ol.lst-kix_iptxq54yrrnf-6.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-6 0}.lst-kix_3a2g7o19wgb3-0>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-0}.lst-kix_f96hgc2s4b68-1>li:before{content:"- "}.lst-kix_f96hgc2s4b68-0>li:before{content:"- "}.lst-kix_f96hgc2s4b68-5>li:before{content:"- "}.lst-kix_f96hgc2s4b68-4>li:before{content:"- "}.lst-kix_5yi4tofw6s0z-6>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-6,decimal) ". "}.lst-kix_9prd8pa3o8y7-3>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-3}ul.lst-kix_yjo4cwnqbjp0-8{list-style-type:none}.lst-kix_5yi4tofw6s0z-1>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-1,lower-latin) ". "}.lst-kix_5yi4tofw6s0z-2>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-2,lower-roman) ". "}ul.lst-kix_yjo4cwnqbjp0-4{list-style-type:none}ul.lst-kix_yjo4cwnqbjp0-5{list-style-type:none}ul.lst-kix_yjo4cwnqbjp0-6{list-style-type:none}ul.lst-kix_yjo4cwnqbjp0-7{list-style-type:none}ul.lst-kix_yjo4cwnqbjp0-0{list-style-type:none}.lst-kix_5yi4tofw6s0z-5>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-5,lower-roman) ". "}ul.lst-kix_yjo4cwnqbjp0-1{list-style-type:none}.lst-kix_8mkn8rg9im4a-7>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-7}ul.lst-kix_yjo4cwnqbjp0-2{list-style-type:none}.lst-kix_f96hgc2s4b68-8>li:before{content:"- "}ul.lst-kix_yjo4cwnqbjp0-3{list-style-type:none}ol.lst-kix_iptxq54yrrnf-0.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-0 0}ol.lst-kix_51hgl6mwb3et-5.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-5 0}.lst-kix_58ja23nrczhl-1>li{counter-increment:lst-ctn-kix_58ja23nrczhl-1}.lst-kix_5yi4tofw6s0z-4>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-4}ol.lst-kix_u3opzkdcnklc-1.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-1 0}.lst-kix_u3opzkdcnklc-4>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-4}ol.lst-kix_iptxq54yrrnf-1.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-1 0}ol.lst-kix_51hgl6mwb3et-4.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-4 0}ol.lst-kix_9prd8pa3o8y7-5.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-5 0}.lst-kix_3a2g7o19wgb3-7>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-7}.lst-kix_t1ae57uxlfl0-8>li:before{content:"- "}.lst-kix_t1ae57uxlfl0-3>li:before{content:"- "}.lst-kix_t1ae57uxlfl0-7>li:before{content:"- "}.lst-kix_t1ae57uxlfl0-4>li:before{content:"- "}ol.lst-kix_u3opzkdcnklc-3{list-style-type:none}ol.lst-kix_u3opzkdcnklc-2{list-style-type:none}ol.lst-kix_u3opzkdcnklc-1{list-style-type:none}.lst-kix_9prd8pa3o8y7-1>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-1}ol.lst-kix_u3opzkdcnklc-0{list-style-type:none}.lst-kix_t1ae57uxlfl0-0>li:before{content:"- "}ol.lst-kix_u3opzkdcnklc-0.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-0 0}.lst-kix_58ja23nrczhl-8>li{counter-increment:lst-ctn-kix_58ja23nrczhl-8}.lst-kix_9prd8pa3o8y7-8>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-8}.lst-kix_7y90gfloiotx-0>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-0,decimal) ". "}.lst-kix_1m9wqzg4mvqt-7>li:before{content:"- "}.lst-kix_aj3gpabmyk88-1>li:before{content:"- "}.lst-kix_58ja23nrczhl-8>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-8,lower-roman) ". "}ol.lst-kix_9prd8pa3o8y7-4.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-4 0}.lst-kix_k47gmg94hbw2-6>li:before{content:"- "}ol.lst-kix_mfudkcwv2w89-0.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-0 0}.lst-kix_j5vmamheymgq-6>li{counter-increment:lst-ctn-kix_j5vmamheymgq-6}.lst-kix_k47gmg94hbw2-2>li:before{content:"- "}.lst-kix_u3opzkdcnklc-6>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-6}ol.lst-kix_u3opzkdcnklc-5.start{counter-reset:lst-ctn-kix_u3opzkdcnklc-5 0}ol.lst-kix_51hgl6mwb3et-0.start{counter-reset:lst-ctn-kix_51hgl6mwb3et-0 0}.lst-kix_9gryrzygx46m-6>li:before{content:"- "}.lst-kix_7y90gfloiotx-3>li{counter-increment:lst-ctn-kix_7y90gfloiotx-3}ol.lst-kix_j5vmamheymgq-7.start{counter-reset:lst-ctn-kix_j5vmamheymgq-7 0}.lst-kix_9gryrzygx46m-2>li:before{content:"- "}.lst-kix_zcvcgbx5ju56-2>li:before{content:"- "}.lst-kix_5yi4tofw6s0z-6>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-6}.lst-kix_zcvcgbx5ju56-6>li:before{content:"- "}.lst-kix_7y90gfloiotx-8>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-8,lower-roman) ". "}.lst-kix_8mkn8rg9im4a-7>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-7,lower-latin) ". "}.lst-kix_7y90gfloiotx-4>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-4,lower-latin) ". "}.lst-kix_51hgl6mwb3et-7>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-7}ol.lst-kix_p4ttii5g8cnl-0.start{counter-reset:lst-ctn-kix_p4ttii5g8cnl-0 0}.lst-kix_8mkn8rg9im4a-3>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-3,decimal) ". "}.lst-kix_1m9wqzg4mvqt-3>li:before{content:"- "}ol.lst-kix_iptxq54yrrnf-5.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-5 0}.lst-kix_aj3gpabmyk88-5>li:before{content:"- "}ol.lst-kix_j5vmamheymgq-6.start{counter-reset:lst-ctn-kix_j5vmamheymgq-6 0}ol.lst-kix_9prd8pa3o8y7-3.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-3 0}ol.lst-kix_hk8k8itxmlfp-2{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-1{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-0{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-8{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-7{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-6{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-5{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-4{list-style-type:none}ol.lst-kix_hk8k8itxmlfp-3{list-style-type:none}ul.lst-kix_k47gmg94hbw2-6{list-style-type:none}ul.lst-kix_k47gmg94hbw2-7{list-style-type:none}ul.lst-kix_k47gmg94hbw2-8{list-style-type:none}.lst-kix_9prd8pa3o8y7-0>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-0}ol.lst-kix_j5vmamheymgq-5.start{counter-reset:lst-ctn-kix_j5vmamheymgq-5 0}ol.lst-kix_5yi4tofw6s0z-3.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-3 0}ul.lst-kix_k47gmg94hbw2-0{list-style-type:none}ul.lst-kix_k47gmg94hbw2-1{list-style-type:none}ul.lst-kix_k47gmg94hbw2-2{list-style-type:none}ul.lst-kix_yzib59bcdnhj-8{list-style-type:none}ul.lst-kix_k47gmg94hbw2-3{list-style-type:none}ul.lst-kix_yzib59bcdnhj-7{list-style-type:none}ul.lst-kix_k47gmg94hbw2-4{list-style-type:none}ul.lst-kix_yzib59bcdnhj-6{list-style-type:none}ul.lst-kix_k47gmg94hbw2-5{list-style-type:none}.lst-kix_p4ttii5g8cnl-0>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-0}ul.lst-kix_yzib59bcdnhj-5{list-style-type:none}.lst-kix_iptxq54yrrnf-3>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-3,decimal) ". "}ul.lst-kix_yzib59bcdnhj-4{list-style-type:none}ul.lst-kix_yzib59bcdnhj-3{list-style-type:none}ul.lst-kix_yzib59bcdnhj-2{list-style-type:none}ul.lst-kix_yzib59bcdnhj-1{list-style-type:none}.lst-kix_iptxq54yrrnf-1>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-1,lower-latin) ". "}ul.lst-kix_yzib59bcdnhj-0{list-style-type:none}.lst-kix_iptxq54yrrnf-0>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-0,decimal) ". "}ol.lst-kix_5oipgjcxugcr-2.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-2 0}.lst-kix_mfudkcwv2w89-0>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-0}.lst-kix_hk8k8itxmlfp-6>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-6}.lst-kix_p4ttii5g8cnl-1>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-1,lower-latin) ". "}.lst-kix_p4ttii5g8cnl-2>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-2,lower-roman) ". "}.lst-kix_3a2g7o19wgb3-8>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-8}.lst-kix_5oipgjcxugcr-6>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-6}.lst-kix_p4ttii5g8cnl-4>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-4,lower-latin) ". "}.lst-kix_mfudkcwv2w89-4>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-4}.lst-kix_51hgl6mwb3et-0>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-0}.lst-kix_hk8k8itxmlfp-2>li{counter-increment:lst-ctn-kix_hk8k8itxmlfp-2}.lst-kix_3a2g7o19wgb3-1>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-1}.lst-kix_58ja23nrczhl-0>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-0,decimal) ". "}ul.lst-kix_g3pd9wzbzpzz-0{list-style-type:none}ol.lst-kix_iptxq54yrrnf-2.start{counter-reset:lst-ctn-kix_iptxq54yrrnf-2 0}ol.lst-kix_mfudkcwv2w89-8.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-8 0}ul.lst-kix_g3pd9wzbzpzz-4{list-style-type:none}ul.lst-kix_g3pd9wzbzpzz-3{list-style-type:none}ul.lst-kix_g3pd9wzbzpzz-2{list-style-type:none}ul.lst-kix_g3pd9wzbzpzz-1{list-style-type:none}.lst-kix_8mkn8rg9im4a-0>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-0}.lst-kix_p4ttii5g8cnl-7>li:before{content:"" counter(lst-ctn-kix_p4ttii5g8cnl-7,lower-latin) ". "}.lst-kix_58ja23nrczhl-3>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-3,decimal) ". "}.lst-kix_mfudkcwv2w89-7>li{counter-increment:lst-ctn-kix_mfudkcwv2w89-7}.lst-kix_9prd8pa3o8y7-4>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-4}ol.lst-kix_mfudkcwv2w89-1.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-1 0}.lst-kix_58ja23nrczhl-1>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-1,lower-latin) ". "}.lst-kix_51hgl6mwb3et-3>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-3}.lst-kix_g3pd9wzbzpzz-2>li:before{content:"- "}.lst-kix_g3pd9wzbzpzz-0>li:before{content:"- "}.lst-kix_g3pd9wzbzpzz-8>li:before{content:"- "}.lst-kix_dqkfvt9lb2wy-4>li:before{content:"- "}.lst-kix_j5vmamheymgq-4>li{counter-increment:lst-ctn-kix_j5vmamheymgq-4}ul.lst-kix_g3pd9wzbzpzz-8{list-style-type:none}.lst-kix_7y90gfloiotx-5>li{counter-increment:lst-ctn-kix_7y90gfloiotx-5}ul.lst-kix_g3pd9wzbzpzz-7{list-style-type:none}ul.lst-kix_g3pd9wzbzpzz-6{list-style-type:none}ul.lst-kix_g3pd9wzbzpzz-5{list-style-type:none}.lst-kix_dqkfvt9lb2wy-2>li:before{content:"- "}.lst-kix_yn2ql2u2egdg-7>li:before{content:"- "}ol.lst-kix_mfudkcwv2w89-3.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-3 0}.lst-kix_mfudkcwv2w89-5>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-5,lower-roman) ". "}.lst-kix_k47gmg94hbw2-7>li:before{content:"- "}.lst-kix_mfudkcwv2w89-3>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-3,decimal) ". "}.lst-kix_k47gmg94hbw2-1>li:before{content:"- "}.lst-kix_3a2g7o19wgb3-5>li{counter-increment:lst-ctn-kix_3a2g7o19wgb3-5}.lst-kix_yn2ql2u2egdg-5>li:before{content:"- "}ol.lst-kix_mfudkcwv2w89-6.start{counter-reset:lst-ctn-kix_mfudkcwv2w89-6 0}.lst-kix_5oipgjcxugcr-7>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-7,lower-latin) ". "}.lst-kix_9gryrzygx46m-5>li:before{content:"- "}ol.lst-kix_9prd8pa3o8y7-8.start{counter-reset:lst-ctn-kix_9prd8pa3o8y7-8 0}.lst-kix_3a2g7o19wgb3-4>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-4,lower-latin) ". "}.lst-kix_5oipgjcxugcr-1>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-1,lower-latin) ". "}.lst-kix_3a2g7o19wgb3-6>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-6,decimal) ". "}.lst-kix_yzib59bcdnhj-3>li:before{content:"- "}.lst-kix_yzib59bcdnhj-1>li:before{content:"- "}.lst-kix_9gryrzygx46m-3>li:before{content:"- "}ul.lst-kix_whw4pjgxp3w1-7{list-style-type:none}ul.lst-kix_whw4pjgxp3w1-8{list-style-type:none}.lst-kix_h1p96gz9lzq4-1>li:before{content:"- "}ul.lst-kix_whw4pjgxp3w1-3{list-style-type:none}ul.lst-kix_whw4pjgxp3w1-4{list-style-type:none}ul.lst-kix_whw4pjgxp3w1-5{list-style-type:none}.lst-kix_u3opzkdcnklc-2>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-2}ul.lst-kix_whw4pjgxp3w1-6{list-style-type:none}ol.lst-kix_j5vmamheymgq-0.start{counter-reset:lst-ctn-kix_j5vmamheymgq-0 0}.lst-kix_9prd8pa3o8y7-7>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-7,lower-latin) ". "}ul.lst-kix_whw4pjgxp3w1-0{list-style-type:none}ul.lst-kix_whw4pjgxp3w1-1{list-style-type:none}.lst-kix_h1p96gz9lzq4-3>li:before{content:"- "}ul.lst-kix_whw4pjgxp3w1-2{list-style-type:none}.lst-kix_9prd8pa3o8y7-1>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-1,lower-latin) ". "}ol.lst-kix_5yi4tofw6s0z-8.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-8 0}.lst-kix_zcvcgbx5ju56-5>li:before{content:"- "}.lst-kix_zcvcgbx5ju56-3>li:before{content:"- "}ol.lst-kix_5oipgjcxugcr-7.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-7 0}ul.lst-kix_1m9wqzg4mvqt-0{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-0.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-0 0}ol.lst-kix_mfudkcwv2w89-0{list-style-type:none}ol.lst-kix_mfudkcwv2w89-1{list-style-type:none}ul.lst-kix_1m9wqzg4mvqt-4{list-style-type:none}ul.lst-kix_1m9wqzg4mvqt-3{list-style-type:none}ul.lst-kix_1m9wqzg4mvqt-2{list-style-type:none}.lst-kix_5oipgjcxugcr-3>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-3}ul.lst-kix_1m9wqzg4mvqt-1{list-style-type:none}.lst-kix_5yi4tofw6s0z-2>li{counter-increment:lst-ctn-kix_5yi4tofw6s0z-2}.lst-kix_j5vmamheymgq-0>li{counter-increment:lst-ctn-kix_j5vmamheymgq-0}.lst-kix_f96hgc2s4b68-2>li:before{content:"- "}.lst-kix_p4ttii5g8cnl-3>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-3}.lst-kix_f96hgc2s4b68-7>li:before{content:"- "}ol.lst-kix_5oipgjcxugcr-5.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-5 0}.lst-kix_7y90gfloiotx-2>li{counter-increment:lst-ctn-kix_7y90gfloiotx-2}.lst-kix_5yi4tofw6s0z-7>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-7,lower-latin) ". "}.lst-kix_u3opzkdcnklc-5>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-5,lower-roman) ". "}ol.lst-kix_5yi4tofw6s0z-6.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-6 0}.lst-kix_u3opzkdcnklc-2>li:before{content:"" counter(lst-ctn-kix_u3opzkdcnklc-2,lower-roman) ". "}.lst-kix_5yi4tofw6s0z-4>li:before{content:"" counter(lst-ctn-kix_5yi4tofw6s0z-4,lower-latin) ". "}.lst-kix_51hgl6mwb3et-6>li{counter-increment:lst-ctn-kix_51hgl6mwb3et-6}ol.lst-kix_5yi4tofw6s0z-5.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-5 0}.lst-kix_5oipgjcxugcr-7>li{counter-increment:lst-ctn-kix_5oipgjcxugcr-7}ul.lst-kix_dqkfvt9lb2wy-2{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-3{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-4{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-5{list-style-type:none}ol.lst-kix_iptxq54yrrnf-2{list-style-type:none}ol.lst-kix_iptxq54yrrnf-1{list-style-type:none}ol.lst-kix_iptxq54yrrnf-0{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-0{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-1{list-style-type:none}ol.lst-kix_iptxq54yrrnf-6{list-style-type:none}ol.lst-kix_iptxq54yrrnf-5{list-style-type:none}ol.lst-kix_iptxq54yrrnf-4{list-style-type:none}ol.lst-kix_iptxq54yrrnf-3{list-style-type:none}ol.lst-kix_iptxq54yrrnf-8{list-style-type:none}ol.lst-kix_iptxq54yrrnf-7{list-style-type:none}.lst-kix_t1ae57uxlfl0-5>li:before{content:"- "}ul.lst-kix_1m9wqzg4mvqt-8{list-style-type:none}ul.lst-kix_1m9wqzg4mvqt-7{list-style-type:none}ul.lst-kix_1m9wqzg4mvqt-6{list-style-type:none}ul.lst-kix_1m9wqzg4mvqt-5{list-style-type:none}.lst-kix_9prd8pa3o8y7-7>li{counter-increment:lst-ctn-kix_9prd8pa3o8y7-7}.lst-kix_8mkn8rg9im4a-3>li{counter-increment:lst-ctn-kix_8mkn8rg9im4a-3}ol.lst-kix_5oipgjcxugcr-4.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-4 0}.lst-kix_t1ae57uxlfl0-2>li:before{content:"- "}ul.lst-kix_dqkfvt9lb2wy-6{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-7{list-style-type:none}ul.lst-kix_dqkfvt9lb2wy-8{list-style-type:none}.lst-kix_g3pd9wzbzpzz-5>li:before{content:"- "}.lst-kix_aj3gpabmyk88-7>li:before{content:"- "}ol.lst-kix_5oipgjcxugcr-4{list-style-type:none}ol.lst-kix_5oipgjcxugcr-3{list-style-type:none}.lst-kix_58ja23nrczhl-6>li:before{content:"" counter(lst-ctn-kix_58ja23nrczhl-6,decimal) ". "}ol.lst-kix_5oipgjcxugcr-2{list-style-type:none}ol.lst-kix_5oipgjcxugcr-3.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-3 0}ul.lst-kix_zcvcgbx5ju56-7{list-style-type:none}ol.lst-kix_5oipgjcxugcr-1{list-style-type:none}.lst-kix_yjo4cwnqbjp0-7>li:before{content:"- "}ul.lst-kix_zcvcgbx5ju56-8{list-style-type:none}ol.lst-kix_5oipgjcxugcr-0{list-style-type:none}ol.lst-kix_5oipgjcxugcr-8{list-style-type:none}ol.lst-kix_5oipgjcxugcr-7{list-style-type:none}ol.lst-kix_5oipgjcxugcr-6{list-style-type:none}ol.lst-kix_5oipgjcxugcr-5{list-style-type:none}.lst-kix_whw4pjgxp3w1-7>li:before{content:"- "}.lst-kix_58ja23nrczhl-7>li{counter-increment:lst-ctn-kix_58ja23nrczhl-7}.lst-kix_p4ttii5g8cnl-6>li{counter-increment:lst-ctn-kix_p4ttii5g8cnl-6}.lst-kix_mfudkcwv2w89-8>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-8,lower-roman) ". "}.lst-kix_yn2ql2u2egdg-2>li:before{content:"- "}.lst-kix_mfudkcwv2w89-0>li:before{content:"" counter(lst-ctn-kix_mfudkcwv2w89-0,decimal) ". "}.lst-kix_k47gmg94hbw2-4>li:before{content:"- "}.lst-kix_dqkfvt9lb2wy-7>li:before{content:"- "}ol.lst-kix_5oipgjcxugcr-1.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-1 0}ul.lst-kix_aj3gpabmyk88-6{list-style-type:none}.lst-kix_5oipgjcxugcr-4>li:before{content:"" counter(lst-ctn-kix_5oipgjcxugcr-4,lower-latin) ". "}ul.lst-kix_aj3gpabmyk88-7{list-style-type:none}ol.lst-kix_5yi4tofw6s0z-2.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-2 0}ul.lst-kix_aj3gpabmyk88-8{list-style-type:none}.lst-kix_9gryrzygx46m-0>li:before{content:"- "}.lst-kix_9gryrzygx46m-8>li:before{content:"- "}.lst-kix_j5vmamheymgq-7>li{counter-increment:lst-ctn-kix_j5vmamheymgq-7}ul.lst-kix_aj3gpabmyk88-2{list-style-type:none}ul.lst-kix_aj3gpabmyk88-3{list-style-type:none}ul.lst-kix_aj3gpabmyk88-4{list-style-type:none}.lst-kix_iptxq54yrrnf-6>li:before{content:"" counter(lst-ctn-kix_iptxq54yrrnf-6,decimal) ". "}ul.lst-kix_aj3gpabmyk88-5{list-style-type:none}.lst-kix_3a2g7o19wgb3-1>li:before{content:"" counter(lst-ctn-kix_3a2g7o19wgb3-1,lower-latin) ". "}ul.lst-kix_aj3gpabmyk88-0{list-style-type:none}ul.lst-kix_aj3gpabmyk88-1{list-style-type:none}.lst-kix_u3opzkdcnklc-5>li{counter-increment:lst-ctn-kix_u3opzkdcnklc-5}.lst-kix_6l3lpr6ytz51-5>li:before{content:"- "}ul.lst-kix_f96hgc2s4b68-0{list-style-type:none}.lst-kix_9prd8pa3o8y7-4>li:before{content:"" counter(lst-ctn-kix_9prd8pa3o8y7-4,lower-latin) ". "}ol.lst-kix_5oipgjcxugcr-0.start{counter-reset:lst-ctn-kix_5oipgjcxugcr-0 0}ul.lst-kix_f96hgc2s4b68-2{list-style-type:none}ul.lst-kix_f96hgc2s4b68-1{list-style-type:none}ul.lst-kix_f96hgc2s4b68-4{list-style-type:none}ul.lst-kix_f96hgc2s4b68-3{list-style-type:none}ul.lst-kix_f96hgc2s4b68-6{list-style-type:none}ul.lst-kix_f96hgc2s4b68-5{list-style-type:none}ul.lst-kix_f96hgc2s4b68-8{list-style-type:none}ul.lst-kix_f96hgc2s4b68-7{list-style-type:none}.lst-kix_1m9wqzg4mvqt-5>li:before{content:"- "}.lst-kix_7y90gfloiotx-6>li:before{content:"" counter(lst-ctn-kix_7y90gfloiotx-6,decimal) ". "}.lst-kix_8mkn8rg9im4a-1>li:before{content:"" counter(lst-ctn-kix_8mkn8rg9im4a-1,lower-latin) ". "}.lst-kix_zcvcgbx5ju56-0>li:before{content:"- "}.lst-kix_zcvcgbx5ju56-8>li:before{content:"- "}.lst-kix_j5vmamheymgq-2>li:before{content:"" counter(lst-ctn-kix_j5vmamheymgq-2,lower-roman) ". "}ol.lst-kix_mfudkcwv2w89-8{list-style-type:none}ol.lst-kix_mfudkcwv2w89-6{list-style-type:none}ol.lst-kix_mfudkcwv2w89-7{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-5{list-style-type:none}ol.lst-kix_mfudkcwv2w89-4{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-6{list-style-type:none}ol.lst-kix_mfudkcwv2w89-5{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-7{list-style-type:none}ol.lst-kix_mfudkcwv2w89-2{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-8{list-style-type:none}ol.lst-kix_mfudkcwv2w89-3{list-style-type:none}.lst-kix_yzib59bcdnhj-6>li:before{content:"- "}ol.lst-kix_9prd8pa3o8y7-1{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-2{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-3{list-style-type:none}ol.lst-kix_9prd8pa3o8y7-4{list-style-type:none}.lst-kix_h1p96gz9lzq4-6>li:before{content:"- "}ol.lst-kix_5yi4tofw6s0z-1.start{counter-reset:lst-ctn-kix_5yi4tofw6s0z-1 0}ol.lst-kix_9prd8pa3o8y7-0{list-style-type:none}ol{margin:0;padding:0}table td,table th{padding:0}.ykcrMYlEiJ-c18{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#e0e0e0;border-top-width:1pt;border-right-width:1pt;border-left-color:#e0e0e0;vertical-align:top;border-right-color:#e0e0e0;border-left-width:1pt;border-top-style:solid;background-color:#fafafa;border-left-style:solid;border-bottom-width:1pt;width:540pt;border-top-color:#e0e0e0;border-bottom-style:solid}.ykcrMYlEiJ-c4{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:180pt;border-top-color:#000000;border-bottom-style:solid}.ykcrMYlEiJ-c24{padding-top:16pt;border-top-width:0pt;padding-bottom:4pt;line-height:1.5;page-break-after:avoid;border-top-style:solid;background-color:#ffffff;border-bottom-width:0pt;border-bottom-style:solid;text-align:left}.ykcrMYlEiJ-c1{color:#1976d2;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:14pt;font-family:"Arial";font-style:normal}.ykcrMYlEiJ-c2{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.ykcrMYlEiJ-c5{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.ykcrMYlEiJ-c30{padding-top:10pt;padding-bottom:10pt;line-height:1.0;page-break-after:avoid;text-align:left}.ykcrMYlEiJ-c6{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left;height:11pt}.ykcrMYlEiJ-c31{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:center}.ykcrMYlEiJ-c36{color:#1976d2;font-weight:700;font-size:15pt;font-style:normal}.ykcrMYlEiJ-c33{border-spacing:0;border-collapse:collapse;margin-right:auto}.ykcrMYlEiJ-c35{font-size:10pt;font-family:Consolas,"Courier New";color:#c53929;font-weight:400}.ykcrMYlEiJ-c14{font-size:10pt;font-family:Consolas,"Courier New";color:#9c27b0;font-weight:400}.ykcrMYlEiJ-c0{font-size:10pt;font-family:Consolas,"Courier New";color:#000000;font-weight:400}.ykcrMYlEiJ-c23{font-size:10pt;font-family:Consolas,"Courier New";color:#455a64;font-weight:400}.ykcrMYlEiJ-c12{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:left}.ykcrMYlEiJ-c10{font-size:10pt;font-family:Consolas,"Courier New";color:#616161;font-weight:400}.ykcrMYlEiJ-c22{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.ykcrMYlEiJ-c9{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.ykcrMYlEiJ-c43{color:#1976d2;font-size:12pt;font-family:"Raleway"}.ykcrMYlEiJ-c3{font-family:Consolas,"Courier New";color:#0d904f;font-weight:400}.ykcrMYlEiJ-c8{font-family:"Times New Roman";font-style:italic;font-weight:400}.ykcrMYlEiJ-c50{text-decoration:none;vertical-align:baseline;font-family:"Times New Roman"}.ykcrMYlEiJ-c51{color:#424242;font-size:15pt;font-family:"Roboto"}.ykcrMYlEiJ-c11{vertical-align:sub;font-family:"Times New Roman";font-weight:400}.ykcrMYlEiJ-c34{text-decoration:none;vertical-align:baseline;font-family:"Arial"}.ykcrMYlEiJ-c13{text-decoration:none;vertical-align:baseline;font-style:normal}.ykcrMYlEiJ-c52{color:#666666;font-size:15pt}.ykcrMYlEiJ-c16{border:1px solid black;margin:5px}.ykcrMYlEiJ-c47{font-size:15pt;color:#1976d2}.ykcrMYlEiJ-c27{padding:0;margin:0}.ykcrMYlEiJ-c19{color:#000000;font-size:11pt}.ykcrMYlEiJ-c41{color:#1976d2;font-size:14pt}.ykcrMYlEiJ-c21{margin-left:72pt;padding-left:0pt}.ykcrMYlEiJ-c45{max-width:540pt;padding:36pt 36pt 36pt 36pt}.ykcrMYlEiJ-c32{font-weight:700;font-style:italic}.ykcrMYlEiJ-c20{orphans:2;widows:2}.ykcrMYlEiJ-c37{text-decoration:none;font-style:normal}.ykcrMYlEiJ-c15{font-weight:400;font-family:"Times New Roman"}.ykcrMYlEiJ-c44{font-weight:400;font-family:"Cambria Math"}.ykcrMYlEiJ-c25{margin-left:36pt;padding-left:0pt}.ykcrMYlEiJ-c26{color:inherit;text-decoration:inherit}.ykcrMYlEiJ-c49{font-weight:400}.ykcrMYlEiJ-c7{background-color:#ffff00}.ykcrMYlEiJ-c29{height:11pt}.ykcrMYlEiJ-c28{background-color:#ffffff}.ykcrMYlEiJ-c40{vertical-align:sub}.ykcrMYlEiJ-c42{font-style:normal}.ykcrMYlEiJ-c38{font-style:italic}.ykcrMYlEiJ-c46{height:23.9pt}.ykcrMYlEiJ-c48{margin-left:36pt}.ykcrMYlEiJ-c39{font-weight:700}.ykcrMYlEiJ-c17{height:0pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:10pt;color:#1976d2;font-weight:700;font-size:15pt;padding-bottom:10pt;font-family:"Arial";line-height:1.0;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:10pt;color:#1976d2;font-size:14pt;padding-bottom:10pt;font-family:"Arial";line-height:1.0;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}</style></head><body class="c28 c45 doc-content"> A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest blog post, where first we'll look at the <a class="ykcrMYlEiJ-c261" href="https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-0920.html">root cause</a> of the CVE-2021-0920 vulnerability. In the second post, we'll dive into the in-the-wild 0-day exploitation of the vulnerability and post-compromise modules.<h1 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.ki897ei81q67">Overview of in-the-wild CVE-2021-0920 exploits</h1> A surveillance vendor named Wintego has developed an exploit for Linux socket syscall 0-day, CVE-2021-0920, and used it in the wild since at least November 2020 based on the earliest captured sample, until the issue was fixed in November 2021.  Combined with Chrome and Samsung browser exploits, the vendor was able to remotely root Samsung devices. The fix was released with the <a class="ykcrMYlEiJ-c261" href="https://source.android.com/security/bulletin/2021-11-01">November 2021 Android Security Bulletin</a>, and applied to Samsung devices in Samsung's December 2021 security update. Google's Threat Analysis Group (TAG) discovered Samsung browser exploit chains being used in the wild. TAG then performed root cause analysis and discovered that this vulnerability, CVE-2021-0920, was being used to escape the sandbox and elevate privileges. CVE-2021-0920 was reported to Linux/Android anonymously. The Google Android Security Team performed the full deep-dive analysis of the exploit. This issue was initially discovered in 2016 by a RedHat kernel developer and disclosed in a public email thread, but the Linux kernel community <a class="ykcrMYlEiJ-c261" href="https://patchwork.ozlabs.org/project/netdev/patch/CAOssrKcfncAYsQWkfLGFgoOxAQJVT2hYVWdBA6Cw7hhO8RJ_wQ@mail.gmail.com/">did not patch</a> the issue until it was re-reported in 2021. Various Samsung devices were targeted, including the Samsung S10 and S20. By abusing an ephemeral race condition in Linux kernel garbage collection, the exploit code was able to obtain a use-after-free (UAF) in a kernel sk_buff object. The in-the-wild sample could effectively circumvent CONFIG_ARM64_UAO, achieve arbitrary read / write primitives and bypass Samsung RKP to elevate to root. Other Android devices were also vulnerable, but we did not find any exploit samples against them. Text extracted from captured samples dubbed the vulnerability “quantum Linux kernel garbage collection”, which appears to be a fitting title for this blogpost.<h1 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.q8pevpc2sw6u">Introduction</h1> CVE-2021-0920 is a use-after-free (UAF) due to a race condition in the garbage collection system for SCM_RIGHTS. SCM_RIGHTS is a control message that allows unix-domain sockets to transmit an open file descriptor from one process to another. In other words, the sender transmits a file descriptor and the receiver then obtains a file descriptor from the sender. This passing of file descriptors adds complexity to reference-counting file structs. To account for this, the Linux kernel community designed a special garbage collection system. CVE-2021-0920 is a vulnerability within this garbage collection system. By winning a race condition during the garbage collection process, an adversary can exploit the UAF on the socket buffer, sk_buff object. In the following sections, we’ll explain the SCM_RIGHTS garbage collection system and the details of the vulnerability. The analysis is based on the Linux 4.14 kernel.<h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.qjne51ghywhs">What is SCM_RIGHTS?</h2> Linux developers can share file descriptors (fd) from one process to another using the <a class="ykcrMYlEiJ-c261" href="https://man7.org/linux/man-pages/man7/unix.7.html">SCM_RIGHTS datagram with the sendmsg syscall</a>. When a process passes a file descriptor to another process, SCM_RIGHTS will add a reference to the underlying file struct. This means that the process that is sending the file descriptors can immediately close the file descriptor on their end, even if the receiving process has not yet accepted and taken ownership of the file descriptors. When the file descriptors are in the “queued” state (meaning the sender has passed the fd and then closed it, but the receiver has not yet accepted the fd and taken ownership), specialized garbage collection is needed. To track this “queued” state, this <a class="ykcrMYlEiJ-c261" href="https://lwn.net/Articles/779472/">LWN article</a> does a great job explaining SCM_RIGHTS reference counting, and it's recommended reading before continuing on with this blogpost.<h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.4irl9u2c0bda">Sending</h2> As stated previously, a unix domain socket uses the syscall sendmsg to send a file descriptor to another socket. To explain the reference counting that occurs during SCM_RIGHTS, we’ll start from the sender’s point of view. We start with the kernel function unix_stream_sendmsg, which implements the sendmsg syscall. To implement the SCM_RIGHTS functionality, the kernel uses the structure scm_fp_list for managing all the transmitted file structures. scm_fp_list stores the list of file pointers to be passed. <a id="t.c96392c69342188701600f62dd8e18978b65546f"></a><a id="t.0"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> struct scm_fp_list {         short                   count;         short                   max;         struct user_struct      *user;         struct file             *fp[SCM_MAX_FD]; };</td></tr></table> unix_stream_sendmsg invokes scm_send (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/af_unix.c#L1886">af_unix.c#L1886</a>) to initialize the scm_fp_list structure, linked by the scm_cookie structure on the stack.<a id="t.15e3db5d013417d6ac8097f3ef1d76367028ae48"></a><a id="t.1"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> struct scm_cookie {         struct pid              *pid;           /* Skb credentials */         struct scm_fp_list      *fp;            /* Passed files         */         struct scm_creds        creds;          /* Skb credentials      */ #ifdef CONFIG_SECURITY_NETWORK         u32                     secid;          /* Passed security ID   */ #endif };</td></tr></table> To be more specific, scm_send → __scm_send → scm_fp_copy (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/core/scm.c#L68">scm.c#L68</a>) reads the file descriptors from the userspace and initializes scm_cookie->fp which can contain SCM_MAX_FD file structures. Since the Linux kernel uses the sk_buff (also known as socket buffers or skb) object to manage all types of socket datagrams, the kernel also needs to invoke the unix_scm_to_skb function to link the scm_cookie->fp to a corresponding skb object. This occurs in unix_attach_fds (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/scm.c#L103">scm.c#L103</a>): <a id="t.7d908bfdc8aa4cf5bff47e5320fdce7dc7e2949e"></a><a id="t.2"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> … /*  * Need to duplicate file references for the sake of garbage  * collection.  Otherwise a socket in the fps might become a  * candidate for GC while the skb is not yet queued.  */ UNIXCB(skb).fp = scm_fp_dup(scm->fp); if (!UNIXCB(skb).fp)         return -ENOMEM; …</td></tr></table> The scm_fp_dup call in unix_attach_fds increases the reference count of the file descriptor that’s being passed so the file is still valid even after the sender closes the transmitted file descriptor later: <a id="t.48360ede8275e8fd7e6e61cd084a628de58bb15f"></a><a id="t.3"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) {         struct scm_fp_list *new_fpl;         int i;         if (!fpl)                 return NULL;         new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),                           GFP_KERNEL);         if (new_fpl) {                 for (i = 0; i < fpl->count; i++)                         get_file(fpl->fp[i]);                 new_fpl->max = new_fpl->count;                 new_fpl->user = get_uid(fpl->user);         }         return new_fpl; }</td></tr></table> Let’s examine a concrete example. Assume we have sockets A and B. The A attempts to pass itself to B. After the SCM_RIGHTS datagram is sent, the newly allocated skb from the sender will be appended to the B’s sk_receive_queue which stores received datagrams: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s1438/image71.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="unix_stream_sendmsg creates sk_buff which contains the structure scm_fp_list. The scm_fp_list has a fp pointer points to the transmitted file (A). The sk_buff is appended to the receiver queue and the reference count of A is 2." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s1200/image71.png" style="max-height: 750px; max-width: 600px;" title="unix_stream_sendmsg creates sk_buff which contains the structure scm_fp_list. The scm_fp_list has a fp pointer points to the transmitted file (A). The sk_buff is appended to the receiver queue and the reference count of A is 2." /></a> sk_buff carries scm_fp_list structure The reference count of A is incremented to 2 and the reference count of B is still 1. <h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.b16dgtqtkmv1">Receiving</h2> Now, let’s take a look at the receiver side unix_stream_read_generic (we will not discuss the MSG_PEEK flag yet, and focus on the normal <a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/af_unix.c#L2445">routine</a>). First of all, the kernel grabs the current skb from sk_receive_queue using skb_peek. Secondly, since scm_fp_list is attached to the skb, the kernel will call unix_detach_fds (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/scm.c#L125">link</a>) to parse the transmitted file structures from skb and clear the skb from sk_receive_queue: <a id="t.d7b1cde66ffafc113438777cb255432b8ed4e0e4"></a><a id="t.4"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> /* Mark read part of skb as used */ if (!(flags & MSG_PEEK)) {         UNIXCB(skb).consumed += chunk;         sk_peek_offset_bwd(sk, chunk);         if (UNIXCB(skb).fp)                 unix_detach_fds(&scm, skb);         if (unix_skb_len(skb))                 break;         skb_unlink(skb, &sk->sk_receive_queue);         consume_skb(skb);         if (scm.fp)                 break;</td></tr></table> The function scm_detach_fds iterates over the list of passed file descriptors (scm->fp) and installs the new file descriptors accordingly for the receiver:<a id="t.cccd27f0609fb1b03a888ddc1137e5fe1004a78a"></a><a id="t.5"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;      i++, cmfptr++) {         struct socket *sock;         int new_fd;         err = security_file_receive(fp[i]);         if (err)                 break;         err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags                                   ? O_CLOEXEC : 0);         if (err < 0)                 break;         new_fd = err;         err = put_user(new_fd, cmfptr);         if (err) {                 put_unused_fd(new_fd);                 break;         }         /* Bump the usage count and install the file. */         sock = sock_from_file(fp[i], &err);         if (sock) {                 sock_update_netprioidx(&sock->sk->sk_cgrp_data);                 sock_update_classid(&sock->sk->sk_cgrp_data);         }         fd_install(new_fd, get_file(fp[i])); } … /*  * All of the files that fit in the message have had their  * usage counts incremented, so we just free the list.  */ __scm_destroy(scm);</td></tr></table> Once the file descriptors have been installed, __scm_destroy (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/core/scm.c#L119">link</a>) cleans up the allocated scm->fp and decrements the file reference count for every transmitted file structure:<a id="t.f6edb942990216f6cb0c4a0bd7dc5c0cd5bf15f9"></a><a id="t.6"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> void __scm_destroy(struct scm_cookie *scm) {         struct scm_fp_list *fpl = scm->fp;         int i;         if (fpl) {                 scm->fp = NULL;                 for (i=fpl->count-1; i>=0; i--)                         fput(fpl->fp[i]);                 free_uid(fpl->user);                 kfree(fpl);         } }</td></tr></table><h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.zi0w3dhxm2me">Reference Counting and Inflight Counting</h2> As mentioned above, when a file descriptor is passed using SCM_RIGHTS, its reference count is immediately incremented. Once the recipient socket has accepted and installed the passed file descriptor, the reference count is then decremented. The complication comes from the “middle” of this operation: after the file descriptor has been sent, but before the receiver has accepted and installed the file descriptor. Let’s consider the following scenario:<ol class="c27 lst-kix_3a2g7o19wgb3-0 start" start="1"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">The process creates sockets A and B.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">A sends socket A to socket B.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">B sends socket B to socket A.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close A.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close B.</li></ol> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixn2j2I0_3XKxc7uimc_-Bd2F7fUflziTRwXRLeCfzDzrA_GKDsDLvqidYluwq_lGptlzWkZ3DD4f2DGnyjuALHuH46yzHjovkrVdzuG-Ncgi4WphgXf9HK_RPnxB91R07fG7cnyy4wZN-M3qZtb6uKOwarRmxIPdQWbJVA-KQlhKQBBR4EZS6aZDe/s724/image66.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="Socket A and B form a reference count cycle." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixn2j2I0_3XKxc7uimc_-Bd2F7fUflziTRwXRLeCfzDzrA_GKDsDLvqidYluwq_lGptlzWkZ3DD4f2DGnyjuALHuH46yzHjovkrVdzuG-Ncgi4WphgXf9HK_RPnxB91R07fG7cnyy4wZN-M3qZtb6uKOwarRmxIPdQWbJVA-KQlhKQBBR4EZS6aZDe/s724/image66.png" style="max-height: 750px; max-width: 600px;" title="Socket A and B form a reference count cycle." /></a> Scenario for reference count cycle Both sockets are closed prior to accepting the passed file descriptors.The reference counts of A and B are both 1 and can't be further decremented because they were removed from the kernel fd table when the respective processes closed them. Therefore the kernel is unable to release the two skbs and sock structures and an unbreakable cycle is formed. The Linux kernel garbage collection system is designed to prevent memory exhaustion in this particular scenario. The inflight count was implemented to identify potential garbage. Each time the reference count is increased due to an SCM_RIGHTS datagram being sent, the inflight count will also be incremented. When a file descriptor is sent by SCM_RIGHTS datagram, the Linux kernel puts its unix_sock into a global list gc_inflight_list. The kernel increments unix_tot_inflight which counts the total number of inflight sockets. Then, the kernel increments u->inflight which tracks the inflight count for each individual file descriptor in the unix_inflight function (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/scm.c#L45">scm.c#L45</a>) invoked from unix_attach_fds: <a id="t.029ba7ef27b97405e8e6fdfbd115b01f42a3bdd9"></a><a id="t.7"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> void unix_inflight(struct user_struct *user, struct file *fp) {         struct sock *s = unix_get_socket(fp);         spin_lock(&unix_gc_lock);         if (s) {                 struct unix_sock *u = unix_sk(s);                 if (atomic_long_inc_return(&u->inflight) == 1) {                         BUG_ON(!list_empty(&u->link));                         list_add_tail(&u->link, &gc_inflight_list);                 } else {                         BUG_ON(list_empty(&u->link));                 }                 unix_tot_inflight++;         }         user->unix_inflight++;         spin_unlock(&unix_gc_lock); }</td></tr></table> Thus, here is what the sk_buff looks like when transferring a file descriptor within sockets A and B: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7JYdav9RAoJLT1TJAAfsVJ6kudGtVBqb8V8Xs0DjEVDEfouQv3SX06oh4AmpRx8UrMNnjqhe0i0FYB6c2jjNtiwGSa1LpHSsg-0AI270tzyX2ziVEHuOO69qTIYhjj780S0oMvXfrdAuyNImJYtBfZ8oUV869w62NV5wshFX3cM0hpmPW219HZT3u/s756/image64.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="When the file descriptor A sends itself to the file descriptor B, the reference count of the file descriptor A is 2 and the inflight count is 1. For the receiver file descriptor B, the file reference count is 1 and the inflight count is 0." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7JYdav9RAoJLT1TJAAfsVJ6kudGtVBqb8V8Xs0DjEVDEfouQv3SX06oh4AmpRx8UrMNnjqhe0i0FYB6c2jjNtiwGSa1LpHSsg-0AI270tzyX2ziVEHuOO69qTIYhjj780S0oMvXfrdAuyNImJYtBfZ8oUV869w62NV5wshFX3cM0hpmPW219HZT3u/s756/image64.png" style="max-height: 750px; max-width: 600px;" title="When the file descriptor A sends itself to the file descriptor B, the reference count of the file descriptor A is 2 and the inflight count is 1. For the receiver file descriptor B, the file reference count is 1 and the inflight count is 0." /></a> The inflight count of A is incremented When the socket file descriptor is received from the other side, the unix_sock.inflight count will be decremented. Let’s revisit the reference count cycle scenario before the close syscall. This cycle is breakable because any socket files can receive the transmitted file and break the reference cycle:  <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXASWOd1HPgwueBa5J636vqpj3uP4onThAwMEL0K_ZBBh3mUr5WklN_YPLIYzXaKl2aSpzcf_odw0ymXe-k7wewgh592dQfkj8AYn6r4jHVh6TXpML2-zsCyFt6ZjmR8N-hcyCeHIwVDjtgCGuRU-YfulCdMk5GWTu9h7X8N7iuCV7GXkzLOKEwFy9/s704/image70.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="The file descriptor A sends itself to the file descriptor B and vice versa. The inflight count of the file descriptor A and B is both 1 and the file reference count is both 2." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXASWOd1HPgwueBa5J636vqpj3uP4onThAwMEL0K_ZBBh3mUr5WklN_YPLIYzXaKl2aSpzcf_odw0ymXe-k7wewgh592dQfkj8AYn6r4jHVh6TXpML2-zsCyFt6ZjmR8N-hcyCeHIwVDjtgCGuRU-YfulCdMk5GWTu9h7X8N7iuCV7GXkzLOKEwFy9/s704/image70.png" style="max-height: 750px; max-width: 600px;" title="The file descriptor A sends itself to the file descriptor B and vice versa. The inflight count of the file descriptor A and B is both 1 and the file reference count is both 2." /></a> Breakable cycle before close A and B After closing both of the file descriptors, the reference count equals the inflight count for each of the socket file descriptors, which is a sign of possible garbage: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiLYC-jGxNwF2UbjAZgIsusMaCUGbBo61ZVRxLljS27iXShVhfCth-_lXBBevW9hyWaIcKBWdkX_6BixTMWNDoE56ZrUFbiKLolrc8orEqPTp_0ITjwRfxUzJZwvaJZWkomMlkM-_Lqr1DdFQVKjnEW_nnuSOz51JCvu-xZDterJudPenVekqGpqP-/s700/image61.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="The cycle becomes unbreakable after closing A and B. The reference count equals to the inflight count for A and B." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiLYC-jGxNwF2UbjAZgIsusMaCUGbBo61ZVRxLljS27iXShVhfCth-_lXBBevW9hyWaIcKBWdkX_6BixTMWNDoE56ZrUFbiKLolrc8orEqPTp_0ITjwRfxUzJZwvaJZWkomMlkM-_Lqr1DdFQVKjnEW_nnuSOz51JCvu-xZDterJudPenVekqGpqP-/s700/image61.png" style="max-height: 750px; max-width: 600px;" title="The cycle becomes unbreakable after closing A and B. The reference count equals to the inflight count for A and B." /></a> Unbreakable cycle after close A and B Now, let’s check another example. Assume we have sockets A, B and 𝛼:<ol class="c27 lst-kix_9prd8pa3o8y7-0 start" start="1"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">A sends socket A to socket B.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">B sends socket B to socket A.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">B sends socket B to socket 𝛼.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">𝛼 sends socket 𝛼 to socket B.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close A.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close B.</li></ol> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnuMdkCyfn1Xhzr4NJiNcf3Oxt8ZB8kCVOZEIIVcuTGoHGEq37NFy44gE-wgNaaIZiwoSE0iWSpfifiXtfEMc0qec9_Lih7VE3xqzQJ6PjIGMT7K6Jcz0VLfYELIev025FXRJbnmnKHdChHBnk7DnjFQSRe0kB8k9zoXBP_ZYh7SYlCkQ08qHYhyxY/s1999/image68.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="A, B and alpha form a breakable cycle." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnuMdkCyfn1Xhzr4NJiNcf3Oxt8ZB8kCVOZEIIVcuTGoHGEq37NFy44gE-wgNaaIZiwoSE0iWSpfifiXtfEMc0qec9_Lih7VE3xqzQJ6PjIGMT7K6Jcz0VLfYELIev025FXRJbnmnKHdChHBnk7DnjFQSRe0kB8k9zoXBP_ZYh7SYlCkQ08qHYhyxY/s1200/image68.png" style="max-height: 750px; max-width: 600px;" title="A, B and alpha form a breakable cycle." /></a> Breakable cycle for A, B and 𝛼 The cycle is breakable, because we can get newly installed file descriptor B’ from the socket file descriptor 𝛼 and newly installed file descriptor A' from B’.<h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.6bkr31v5bx7w">Garbage Collection</h2> A high level view of garbage collection is available from <a class="ykcrMYlEiJ-c261" href="https://lwn.net/Articles/779472/">lwn.net</a>: "If, instead, the two counts are equal, that file structure might be part of an unreachable cycle. To determine whether that is the case, the kernel finds the set of all in-flight Unix-domain sockets for which all references are contained in SCM_RIGHTS datagrams (for which f_count and inflight are equal, in other words). It then counts how many references to each of those sockets come from SCM_RIGHTS datagrams attached to sockets in this set. Any socket that has references coming from outside the set is reachable and can be removed from the set. If it is reachable, and if there are any SCM_RIGHTS datagrams waiting to be consumed attached to it, the files contained within that datagram are also reachable and can be removed from the set. At the end of an iterative process, the kernel may find itself with a set of in-flight Unix-domain sockets that are only referenced by unconsumed (and unconsumable) SCM_RIGHTS datagrams; at this point, it has a cycle of file structures holding the only references to each other. Removing those datagrams from the queue, releasing the references they hold, and discarding them will break the cycle." To be more specific, the SCM_RIGHTS garbage collection system was developed in order to handle the unbreakable reference cycles. To identify which file descriptors are a part of unbreakable cycles:<ol class="c27 lst-kix_iptxq54yrrnf-0 start" start="1"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Add any unix_sock objects whose reference count equals its inflight count to the gc_candidates list.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Determine if the socket is referenced by any sockets outside of the gc_candidates list. If it is then it is reachable, remove it and any sockets it references from the gc_candidates list. Repeat until no more reachable sockets are found.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">After this iterative process, only sockets who are solely referenced by other sockets within the gc_candidates list are left. </li></ol> Let’s take a closer look at how this garbage collection process works. First, the kernel finds all the unix_sock objects whose reference counts equals their inflight count and puts them into the gc_candidates list (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/garbage.c#L242">garbage.c#L242)</a>: <a id="t.abfa5bba6c1c21ddf7addd07cef8c63ba518ddc9"></a><a id="t.8"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> list_for_each_entry_safe(u, next, &gc_inflight_list, link) {         long total_refs;         long inflight_refs;         total_refs = file_count(u->sk.sk_socket->file);         inflight_refs = atomic_long_read(&u->inflight);         BUG_ON(inflight_refs < 1);         BUG_ON(total_refs < inflight_refs);         if (total_refs == inflight_refs) {                 list_move_tail(&u->link, &gc_candidates);                 __set_bit(UNIX_GC_CANDIDATE, &u->gc_flags);                 __set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);         } }</td></tr></table> Next, the kernel removes any sockets that are referenced by other sockets outside of the current gc_candidates list. To do this, the kernel invokes scan_children (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/garbage.c#L138">garbage.c#138</a>) along with the function pointer dec_inflight to iterate through each candidate’s sk->receive_queue. It decreases the inflight count for each of the passed file descriptors that are themselves candidates for garbage collection (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/garbage.c#L261">garbage.c#L261</a>): <a id="t.fc28a79164e4bd7a8bdd4781c31aead0becb7e3a"></a><a id="t.9"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> /* Now remove all internal in-flight reference to children of  * the candidates.  */ list_for_each_entry(u, &gc_candidates, link)         scan_children(&u->sk, dec_inflight, NULL);</td></tr></table> After iterating through all the candidates, if a gc candidate still has a positive inflight count it means that it is referenced by objects outside of the gc_candidates list and therefore is reachable. These candidates should not be included in the gc_candidates list so the related inflight counts need to be restored. To do this, the kernel will put the candidate to not_cycle_list instead and iterates through its receiver queue of each transmitted file in the gc_candidates list (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/garbage.c#L281">garbage.c#L281</a>) and increments the inflight count back. The entire process is done recursively, in order for the garbage collection to avoid purging reachable sockets: <a id="t.361a83de28e804a554f56db20f03ccfb1d948e58"></a><a id="t.10"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> /* Restore the references for children of all candidates,  * which have remaining references.  Do this recursively, so  * only those remain, which form cyclic references.  *  * Use a "cursor" link, to make the list traversal safe, even  * though elements might be moved about.  */ list_add(&cursor, &gc_candidates); while (cursor.next != &gc_candidates) {         u = list_entry(cursor.next, struct unix_sock, link);         /* Move cursor to after the current position. */         list_move(&cursor, &u->link);         if (atomic_long_read(&u->inflight) > 0) {                 list_move_tail(&u->link, &not_cycle_list);                 __clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);                 scan_children(&u->sk, inc_inflight_move_tail, NULL);         } } list_del(&cursor);</td></tr></table> Now gc_candidates contains only “garbage”. The kernel restores original inflight counts from gc_candidates, moves candidates from not_cycle_list back to gc_inflight_list and invokes __skb_queue_purge for cleaning up garbage (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/garbage.c#L306">garbage.c#L306</a>). <a id="t.193055a25333ec1cdf4b6d039bbb9233e94a0884"></a><a id="t.11"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> /* Now gc_candidates contains only garbage.  Restore original  * inflight counters for these as well, and remove the skbuffs  * which are creating the cycle(s).  */ skb_queue_head_init(&hitlist); list_for_each_entry(u, &gc_candidates, link)         scan_children(&u->sk, inc_inflight, &hitlist); /* not_cycle_list contains those sockets which do not make up a  * cycle.  Restore these to the inflight list.  */ while (!list_empty(&not_cycle_list)) {         u = list_entry(not_cycle_list.next, struct unix_sock, link);         __clear_bit(UNIX_GC_CANDIDATE, &u->gc_flags);         list_move_tail(&u->link, &gc_inflight_list); } spin_unlock(&unix_gc_lock); /* Here we are. Hitlist is filled. Die. */ __skb_queue_purge(&hitlist); spin_lock(&unix_gc_lock);</td></tr></table> __skb_queue_purge clears every skb from the receiver queue: <a id="t.ef5f1527ea6a99948aacf9ba31c9a016e0a52e01"></a><a id="t.12"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> /**  *      __skb_queue_purge - empty a list  *      @list: list to empty  *  *      Delete all buffers on an &sk_buff list. Each buffer is removed from  *      the list and one reference dropped. This function does not take the  *      list lock and the caller must hold the relevant locks to use it.  */ void skb_queue_purge(struct sk_buff_head *list); static inline void __skb_queue_purge(struct sk_buff_head *list) {         struct sk_buff *skb;         while ((skb = __skb_dequeue(list)) != NULL)                 kfree_skb(skb); }</td></tr></table> There are two ways to trigger the garbage collection process:<ol class="c27 lst-kix_58ja23nrczhl-0 start" start="1"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">wait_for_unix_gc is invoked at the beginning of the sendmsg function if there are more than 16,000 inflight sockets</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">When a socket file is released by the kernel (i.e., a file descriptor is closed), the kernel will directly invoke unix_gc.</li></ol> Note that unix_gc is not preemptive. If garbage collection is already in process, the kernel will not perform another unix_gc invocation. Now, let’s check this example (a breakable cycle) with a pair of sockets f00 and f01, and a single socket 𝛼:<ol class="c27 lst-kix_51hgl6mwb3et-0 start" start="1"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Socket f 00 sends socket f 00 to socket f 01.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Socket f 01 sends socket f 01 to socket 𝛼.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close f 00.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close f 01.</li></ol> Before starting the garbage collection process, the status of socket file descriptors are:<ul style="padding: 0;" class="c27 lst-kix_yzib59bcdnhj-0 start"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 00: ref = 1, inflight = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 01: ref = 1, inflight = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">𝛼: ref = 1, inflight = 0</li></ul> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfD3EkqhRCP3nucxrm7-5h2T0Z0Q9e2xWhLX_CA07nU5IWXOAejwDvqPBd2CeJVLrM5bg502cpkm2noANVBV24QVmHRGA3IkHF_at3u6i2rYCHZH4wpvS5EfIC6ibJgtZb4LSO2IjdNbqw_PawxHzGAI9LtmhXRO5rv8SDTHa5mwncMXptSJmjnBZx/s834/image69.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="f00, f01 and alpha form a breakable cycle." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfD3EkqhRCP3nucxrm7-5h2T0Z0Q9e2xWhLX_CA07nU5IWXOAejwDvqPBd2CeJVLrM5bg502cpkm2noANVBV24QVmHRGA3IkHF_at3u6i2rYCHZH4wpvS5EfIC6ibJgtZb4LSO2IjdNbqw_PawxHzGAI9LtmhXRO5rv8SDTHa5mwncMXptSJmjnBZx/s834/image69.png" style="max-height: 750px; max-width: 600px;" title="f00, f01 and alpha form a breakable cycle." /></a> Breakable cycle by f 00, f 01 and 𝛼 During the garbage collection process, f 00 and f 01 are considered garbage candidates. The inflight count of f 00 is dropped to zero, but the count of f 01 is still 1 because 𝛼 is not a candidate. Thus, the kernel will restore the inflight count from f 01’s receive queue. As a result, f 00 and f 01 are not treated as garbage anymore.<h1 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.rjtckjrq5zqp">CVE-2021-0920 Root Cause Analysis</h1> When a user receives SCM_RIGHTS message from recvmsg without the MSG_PEEK flag, the kernel will wait until the garbage collection process finishes if it is in progress. However, if the MSG_PEEK flag is on, the kernel will increment the reference count of the transmitted file structures without synchronizing with any ongoing garbage collection process. This may lead to inconsistency of the internal garbage collection state, making the garbage collector mark a non-garbage sock object as garbage to purge. <h2 class="ykcrMYlEiJ-c20 ykcrMYlEiJ-c30" id="h.7lz5lcv6k4oi">recvmsg without MSG_PEEK flag</h2> The kernel function unix_stream_read_generic (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/af_unix.c#L2290">af_unix.c#L2290</a>) parses the SCM_RIGHTS message and manages the file inflight count when the MSG_PEEK flag is NOT set. Then, the function unix_stream_read_generic calls unix_detach_fds to decrement the inflight count. Then, unix_detach_fds clears the list of passed file descriptors (scm_fp_list) from the skb: <a id="t.0251da5f97c6a33bfc5ce0e11f69ded3f816103b"></a><a id="t.13"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) {         int i;         scm->fp = UNIXCB(skb).fp;         UNIXCB(skb).fp = NULL;         for (i = scm->fp->count-1; i >= 0; i--)                 unix_notinflight(scm->fp->user, scm->fp->fp[i]); }</td></tr></table> The unix_notinflight from unix_detach_fds will reverse the effect of unix_inflight by decrementing the inflight count: <a id="t.d890a653a46688c713ffbe9f71996b050052c85f"></a><a id="t.14"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> void unix_notinflight(struct user_struct *user, struct file *fp) {         struct sock *s = unix_get_socket(fp);         spin_lock(&unix_gc_lock);         if (s) {                 struct unix_sock *u = unix_sk(s);                 BUG_ON(!atomic_long_read(&u->inflight));                 BUG_ON(list_empty(&u->link));                 if (atomic_long_dec_and_test(&u->inflight))                         list_del_init(&u->link);                 unix_tot_inflight--;         }         user->unix_inflight--;         spin_unlock(&unix_gc_lock); }</td></tr></table> Later skb_unlink and consume_skb are invoked from unix_stream_read_generic (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/af_unix.c#L2451">af_unix.c#2451</a>) to destroy the current skb. Following the call chain kfree(skb)->__kfree_skb, the kernel will invoke the function pointer skb->destructor (<a class="ykcrMYlEiJ-c261" href="https://elixir.bootlin.com/linux/v4.14.277/source/net/unix/af_unix.c#L1605">code</a>) which redirects to unix_destruct_scm: <a id="t.d928301c0cdf3e7a332926420806a793608d77ac"></a><a id="t.15"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> static void unix_destruct_scm(struct sk_buff *skb) {         struct scm_cookie scm;         memset(&scm, 0, sizeof(scm));         scm.pid  = UNIXCB(skb).pid;         if (UNIXCB(skb).fp)                 unix_detach_fds(&scm, skb);         /* Alas, it calls VFS */         /* So fscking what? fput() had been SMP-safe since the last Summer */         scm_destroy(&scm);         sock_wfree(skb); }</td></tr></table> In fact, the unix_detach_fds will not be invoked again here from unix_destruct_scm because UNIXCB(skb).fp is already cleared by unix_detach_fds. Finally, fd_install(new_fd, get_file(fp[i])) from scm_detach_fds is invoked for installing a new file descriptor. <h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.yfq48nayx2kg">recvmsg with MSG_PEEK flag</h2> The recvmsg process is different if the MSG_PEEK flag is set. The MSG_PEEK flag is used during receive to “peek” at the message, but the data is treated as unread. unix_stream_read_generic will invoke scm_fp_dup instead of unix_detach_fds. This increases the reference count of the inflight file (<a class="ykcrMYlEiJ-c261" href="https://android.googlesource.com/kernel/goldfish/+/eee65a1282369eedfcbb664d0c865a0ef3eb7017/net/unix/af_unix.c#2149">af_unix.c#2149</a>): <a id="t.54ddd657e781757bb7c1f32330ad770b045c0ed3"></a><a id="t.16"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> /* It is questionable, see note in unix_dgram_recvmsg.  */ if (UNIXCB(skb).fp)         scm.fp = scm_fp_dup(UNIXCB(skb).fp); sk_peek_offset_fwd(sk, chunk); if (UNIXCB(skb).fp)         break;</td></tr></table> Because the data should be treated as unread, the skb is not unlinked and consumed when the MSG_PEEK flag is set. However, the receiver will still get a new file descriptor for the inflight socket. <h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.4kuedi8b9x2y">recvmsg Examples</h2> Let’s see a concrete example. Assume there are the following socket pairs:<ul style="padding: 0;" class="c27 lst-kix_k47gmg94hbw2-0 start"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 00, f 01</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 10, f 11</li></ul> Now, the program does the following operations:<ul style="padding: 0;" class="c27 lst-kix_8chkxhfzc2ds-0 start"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 00 → [f 00] → f 01 (means f 00 sends [f 00] to f 01)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 10 → [f 00] → f 11</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 00)</li></ul> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi5B8kJXBAiYH3vq8NcQtmatM_hz8o9KgBZpMbMyd9QwRC84jh-SZo76fLhvSFrRohs4pUhBW48q3fQ0bUu0DlySHyJhDMC69rz8qwEM8nHK4b1RGLMw9QGwPmf4E7iMjo5Noa6eF-GDEuMqa4Gzq0fwiBCXU_x0i_Q7eGd2OqiIbu7lYFFaErVE5o/s1102/image62.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="f00, f01, f10, f11 forms a breakable cycle." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi5B8kJXBAiYH3vq8NcQtmatM_hz8o9KgBZpMbMyd9QwRC84jh-SZo76fLhvSFrRohs4pUhBW48q3fQ0bUu0DlySHyJhDMC69rz8qwEM8nHK4b1RGLMw9QGwPmf4E7iMjo5Noa6eF-GDEuMqa4Gzq0fwiBCXU_x0i_Q7eGd2OqiIbu7lYFFaErVE5o/s1102/image62.png" style="max-height: 750px; max-width: 600px;" title="f00, f01, f10, f11 forms a breakable cycle." /></a> Breakable cycle by f 00, f 01, f 10 and f 11 Here is the status:<ul style="padding: 0;" class="c27 lst-kix_9gryrzygx46m-0 start"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 00) = 2, ref(f 00) = 2</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 01) = 0, ref(f 01) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 10) = 0, ref(f 10) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 11) = 0, ref(f 11) = 1</li></ul> If the garbage collection process happens now, before any recvmsg calls, the kernel will choose f 00 as the garbage candidate. However, f 00 will not have the inflight count altered and the kernel will not purge any garbage. If f 01 then calls recvmsg with MSG_PEEK flag, the receive queue doesn’t change and the inflight counts are not decremented. f 01 gets a new file descriptor f 00' which increments the reference count on f 00: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO9D3ODJFXZt6dQmkyP1e7zZe0smN042wAbdy7isVbd407L-oCrSDS9LDCBshKwft2pWiuKHXQBclib4tQFoou-8U14ZNuyeJMRxDjtuFsTk3B_TDHVQNDl5x8aLt09negBlNpoEzrYgybadh-KbAAGu_U4hqaDNLyOpWFbI06Vjfh1kam2JHuD7yH/s1216/image63.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="After f01 receives the socket file descriptor by MSG_PEEK, the reference count of f00 is incremented and the receive queue from f01 remains the same." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhO9D3ODJFXZt6dQmkyP1e7zZe0smN042wAbdy7isVbd407L-oCrSDS9LDCBshKwft2pWiuKHXQBclib4tQFoou-8U14ZNuyeJMRxDjtuFsTk3B_TDHVQNDl5x8aLt09negBlNpoEzrYgybadh-KbAAGu_U4hqaDNLyOpWFbI06Vjfh1kam2JHuD7yH/s1216/image63.png" style="max-height: 750px; max-width: 600px;" title="After f01 receives the socket file descriptor by MSG_PEEK, the reference count of f00 is incremented and the receive queue from f01 remains the same." /></a> MSG_PEEK increment the reference count of f 00 while the receive queue is not cleared Status:<ul style="padding: 0;" class="c27 lst-kix_9gryrzygx46m-0"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 00) = 2, ref(f 00) = 3</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 01) = 0, ref(f 01) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 10) = 0, ref(f 10) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 11) = 0, ref(f 11) = 1</li></ul> Then, f 01 calls recvmsg without MSG_PEEK flag, f 01’s receive queue is removed. f 01 also fetches a new file descriptor f 00'': <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNsC7ADpPbHG_EVgFzDOGi6oaXluRrxDKc6kaQAkdwadnfFOu4SbwVESi0-SGHDwu9La-ztndastPnhfiocmhd6fmU0mhCy9a5sDosCQu6eW3x_uu7wHGL5d1c0eMTO3inZlhObh4faQkcGU2fM6zd-cXDjbg6fjS6CKUMpT8Sre9XHefE7Exrt04s/s1344/image67.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="After f01 receives the socket file descriptor without MSG_PEEK, the receive queue is cleared and file descriptor f00''' is obtained." border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNsC7ADpPbHG_EVgFzDOGi6oaXluRrxDKc6kaQAkdwadnfFOu4SbwVESi0-SGHDwu9La-ztndastPnhfiocmhd6fmU0mhCy9a5sDosCQu6eW3x_uu7wHGL5d1c0eMTO3inZlhObh4faQkcGU2fM6zd-cXDjbg6fjS6CKUMpT8Sre9XHefE7Exrt04s/s1200/image67.png" style="max-height: 750px; max-width: 600px;" title="After f01 receives the socket file descriptor without MSG_PEEK, the receive queue is cleared and file descriptor f00''' is obtained." /></a> The receive queue of f 01 is cleared and f 01'' is obtained from f 01 Status:<ul style="padding: 0;" class="c27 lst-kix_9gryrzygx46m-0"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 00) = 1, ref(f 00) = 3</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 01) = 0, ref(f 01) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 10) = 0, ref(f 10) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 11) = 0, ref(f 11) = 1</li></ul> <h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.v0psi01ks7q2">UAF Scenario</h2> From a very high level perspective, the internal state of Linux garbage collection can be non-deterministic because MSG_PEEK is not synchronized with the garbage collector. There is a race condition where the garbage collector can treat an inflight socket as a garbage candidate while the file reference is incremented at the same time during the MSG_PEEK receive. As a consequence, the garbage collector may purge the candidate, freeing the socket buffer, while a receiver may install the file descriptor, leading to a UAF on the skb object. Let’s see how the captured 0-day sample triggers the bug step by step (simplified version, in reality you may need more threads working together, but it should demonstrate the core idea). First of all, the sample allocates the following socket pairs and single socket 𝛼:<ul style="padding: 0;" class="c27 lst-kix_whw4pjgxp3w1-0 start"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 00, f 01</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 10, f 11</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 20, f 21</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">f 30, f 31</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">sock 𝛼 (actually there might be even thousands of 𝛼 for protracting the garbage collection process in order to evade a BUG_ON check which will be introduced later).</li></ul> Now, the program does the below operations: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAHUeccUboPeEe8ydW1HHpM2R-iibCZnsJSrhByCsnhQHtW4IJcC_8GEPtO3R3GPV5x2C9xJfxT7l6Z3UoqRcUeMtuf65G9wI2tPnd91q_vO7spVOfZgAwjeC6WCILmjs1ED618PGlxgMp196O3odP-fKaqIloMSEYRNory126HtXPNyyXCUWefJew/s564/image17.png" style="display: block; padding: 1em 0;text-align: left;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAHUeccUboPeEe8ydW1HHpM2R-iibCZnsJSrhByCsnhQHtW4IJcC_8GEPtO3R3GPV5x2C9xJfxT7l6Z3UoqRcUeMtuf65G9wI2tPnd91q_vO7spVOfZgAwjeC6WCILmjs1ED618PGlxgMp196O3odP-fKaqIloMSEYRNory126HtXPNyyXCUWefJew/s564/image17.png" style="max-height: 750px; max-width: 250px; border:0; box-shadow: none; --webkit-box-shadow: none; --moz-box-shadow: none;" title="" /></a> Close the following file descriptors prior to any recvmsg calls:<ul style="padding: 0;" class="c27 lst-kix_9gryrzygx46m-0"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 00)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 01)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 11)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 10)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 30)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(f 31)</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Close(𝛼)</li></ul> Here is the status:<ul style="padding: 0;" class="c27 lst-kix_9gryrzygx46m-0"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 00) = N + 1, ref(f 00) = N + 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 01) = 2, ref(f 01) = 2</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 10) = 3, ref(f 10) = 3</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 11) = 1, ref(f 11) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 20) = 0, ref(f 20) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 21) = 0, ref(f 21) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(f 31) = 1, ref(f 31) = 1</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">inflight(𝛼) = 1, ref(𝛼) = 1</li></ul> If the garbage collection process happens now, the kernel will do the following scrutiny:<ul style="padding: 0;" class="c27 lst-kix_h1p96gz9lzq4-0 start"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">List f 00, f 01, f 10,  f 11, f 31, 𝛼 as garbage candidates. Decrease inflight count for the candidate children in each receive queue.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Since f 21 is not considered a candidate, f 11’s inflight count is still above zero.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Recursively restore the inflight count.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Nothing is considered garbage.</li></ul> A potential skb UAF by race condition can be triggered by:<ol class="c27 lst-kix_j5vmamheymgq-0 start" start="1"><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Call recvmsg with MSG_PEEK flag from f 21 to get f 11’.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Call recvmsg with MSG_PEEK flag from f 11 to get f 10’.</li><li style="margin-left: 46pt;" class="c12 c20 c25 li-bullet-0">Concurrently do the following operations:</li></ol><ol class="c27 lst-kix_j5vmamheymgq-1 start" start="1"><li style="margin-left: 46pt;" class="c12 c21 c20 li-bullet-0">Call recvmsg without MSG_PEEK flag from f 11 to get f 10’’.</li><li style="margin-left: 46pt;" class="c12 c20 c21 li-bullet-0">Call recvmsg with MSG_PEEK flag from f 10’</li></ol> How is it possible? Let’s see a case where the race condition is not hit so there is no UAF:<a id="t.b47553220f0960b2834e887266a030fb4dc49b24"></a><a id="t.17"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Thread 0</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Thread 1</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Thread 2</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call unix_gc</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage0: List f 00, f 01, f 10,  f 11, f 31, 𝛼 as garbage candidates.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg with MSG_PEEK flag from f 21 to get f 11’</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Increase reference count: scm.fp = scm_fp_dup(UNIXCB(skb).fp);</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage0: decrease inflight count from the child of every garbage candidate</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Status after stage 0: inflight(f 00) = 0 inflight(f 01) = 0 inflight(f 10) = 0 inflight(f 11) = 1 inflight(f 31) = 0 inflight(𝛼) = 0</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage1: Recursively restore inflight count if a candidate still has inflight count. </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage1: All inflight counts have been restored.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage2: No garbage, return.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg with MSG_PEEK flag from f 11 to get f 10’</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg without MSG_PEEK flag from f 11 to get f 10’’</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg with MSG_PEEK flag from f 10’</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Everyone is happy</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Everyone is happy</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Everyone is happy</td></tr></table> However, if the second recvmsg occurs just after stage 1 of the garbage collection process, the UAF is triggered: <a id="t.4cb3bda9bda9e3eb3317a2b662883e2cb8968cd6"></a><a id="t.18"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Thread 0</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Thread 1</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Thread 2</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call unix_gc</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage0: List f 00, f 01, f 10,  f 11, f 31, 𝛼 as garbage candidates.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg with MSG_PEEK flag from f 21 to get f 11’</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Increase reference count: scm.fp = scm_fp_dup(UNIXCB(skb).fp);</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage0: decrease inflight count from the child of every garbage candidates</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Status after stage 0: inflight(f 00) = 0 inflight(f 01) = 0 inflight(f 10) = 0 inflight(f 11) = 1 inflight(f 31) = 0 inflight(𝛼) = 0</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage1: Start restoring inflight count.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg with MSG_PEEK flag from f 11 to get f 10’</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c46"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Call recvmsg without MSG_PEEK flag from f 11 to get f 10’’</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> unix_detach_fds: UNIXCB(skb).fp = NULL</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Blocked by spin_lock(&unix_gc_lock)</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage1: scan_inflight cannot find candidate children from f 11. Thus, the inflight count accidentally remains the same.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage2: f 00, f 01, f 10, f 31, 𝛼 are garbage.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage2: start purging garbage.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Start calling recvmsg with MSG_PEEK flag from f 10’, which would expect to receive f 00'</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Get skb = skb_peek(&sk->sk_receive_queue), skb is going to be freed by thread 0.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Stage2: for<img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRTVI1goYtLkJZYRh0P5Wj_jeCjDeIhbMLEzwbzMCMWdag6uBicpIv7TtDorvArzkMmQGMRq6Ss5WdVDwyKTZE9frPBY44fOF667d2D7rKxarcAfp9x9t-YrNRielyFYOgI0998OI0TplaeHW7CGyz4SAFs2udorAlUMxe4gaCPYqr2zP9AjmKbyip/s260/image18.png" style="max-height: 750px; max-width: 100px; box-shadow: none; --webkit-box-shadow: none; --moz-box-shadow: none; border:0; display: inline;" title="" />, calls __skb_unlink and kfree_skb later.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> state->recv_actor(skb, skip, chunk, state) UAF</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> GC finished.</td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Start garbage collection.</td></tr><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> </td><td class="ykcrMYlEiJ-c4" colspan="1" rowspan="1"> Get f 10’’</td></tr></table> Therefore, the race condition causes a UAF of the skb object. At first glance, we should blame the second recvmsg syscall because it clears skb.fp, the passed file list. However, if the first recvmsg syscall doesn’t set the MSG_PEEK flag, the UAF can be avoided because unix_notinflight is serialized with the garbage collection. In other words, the kernel makes sure the garbage collection is either not processed or finished before decrementing the inflight count and removing the skb. After unix_notinflight, the receiver obtains f11' and inflight sockets don't form an unbreakable cycle. Since MSG_PEEK is not serialized with the garbage collection, when recvmsg is called with MSG_PEEK set, the kernel still considers f 11 as a garbage candidate. For this reason, the following next recvmsg will eventually trigger the bug due to the inconsistent state of the garbage collection process.  <h1 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.wrjvlggcdxoy">Patch Analysis</h1><h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.de5p59plssty">CVE-2021-0920 was found in 2016</h2> The vulnerability was <a class="ykcrMYlEiJ-c261" href="https://patchwork.ozlabs.org/project/netdev/patch/CAOssrKcfncAYsQWkfLGFgoOxAQJVT2hYVWdBA6Cw7hhO8RJ_wQ@mail.gmail.com/">initially reported to the Linux kernel community in 2016</a>. The researcher also provided the correct patch advice but it was not accepted by the Linux kernel community: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8WLJ5TaSrwBSyzsB2cnn3WlhRBqZzDHyOAnU8PWvMGr9d2l85FCYHw8fwiHRmFRMtPBMSe3kcFyISMGzuqmFyc0Ks5gJymqNPxh_kHdy59iHrUXTkpc5MTEyoOSroIHMzmqgQCibycvyxMRR-kUmjKIB3y0kqNHvN1TQULEUY8f04pIe65f-z3l3A/s1202/image65.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="Linux kernel developers: Why would I apply a patch that's an RFC, doesn't have a proper commit message, lacks a proper signoff, and also lacks ACK's and feedback from other knowledgable developers?" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8WLJ5TaSrwBSyzsB2cnn3WlhRBqZzDHyOAnU8PWvMGr9d2l85FCYHw8fwiHRmFRMtPBMSe3kcFyISMGzuqmFyc0Ks5gJymqNPxh_kHdy59iHrUXTkpc5MTEyoOSroIHMzmqgQCibycvyxMRR-kUmjKIB3y0kqNHvN1TQULEUY8f04pIe65f-z3l3A/s1202/image65.png" style="max-height: 750px; max-width: 600px;" title="Linux kernel developers: Why would I apply a patch that's an RFC, doesn't have a proper commit message, lacks a proper signoff, and also lacks ACK's and feedback from other knowledgable developers?" /></a> Patch was not applied in 2016 In theory, anyone who saw this patch might come up with an exploit against the faulty garbage collector. <h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.4z83prp6b89e">Patch in 2021</h2> Let’s check the official <a class="ykcrMYlEiJ-c261" href="https://lore.kernel.org/lkml/20210802134333.066918619@linuxfoundation.org/">patch</a> for CVE-2021-0920. For the MSG_PEEK branch, it requests the garbage collection lock unix_gc_lock before performing sensitive actions and immediately releases it afterwards: <a id="t.35ff1e948ec741d79429e84cee5745d3afcaaae5"></a><a id="t.19"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> … +       spin_lock(&unix_gc_lock); +       spin_unlock(&unix_gc_lock); …</td></tr></table> The patch is confusing - it’s rare to see such lock usage in software development. Regardless, the MSG_PEEK flag now waits for the completion of the garbage collector, so the UAF issue is resolved.<h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.9ft0l34fnpmk">BUG_ON Added in 2017</h2> Andrey Ulanov from Google in 2017 found another issue in unix_gc and provided a fix <a class="ykcrMYlEiJ-c261" href="https://lore.kernel.org/lkml/20170315031642.19576-1-andreyu@google.com/">commit</a>. Additionally, the patch added a BUG_ON for the inflight count: <a id="t.9ddfb92c81bd3f8420f9ee8f3bc9bd197a02f533"></a><a id="t.20"></a><table class="ykcrMYlEiJ-c33"><tr class="ykcrMYlEiJ-c17"><td class="ykcrMYlEiJ-c18" colspan="1" rowspan="1"> void unix_notinflight(struct user_struct *user, struct file *fp)         if (s) {                 struct unix_sock *u = unix_sk(s);   +               BUG_ON(!atomic_long_read(&u->inflight));                 BUG_ON(list_empty(&u->link));                   if (atomic_long_dec_and_test(&u->inflight))</td></tr></table> At first glance, it seems that the BUG_ON can prevent CVE-2021-0920 from being exploitable. However, if the exploit code can delay garbage collection by crafting a large amount of fake garbage,  it can waive the BUG_ON check by heap spray. <h2 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.f7eb84wuwvc6">New Garbage Collection Discovered in 2021</h2> CVE-2021-4083 deserves an honorable mention: when I discussed CVE-2021-0920 with Jann Horn and Ben Hawkes, Jann found another <a class="ykcrMYlEiJ-c261" href="https://bugs.chromium.org/p/project-zero/issues/detail?id=2247">issue</a> in the garbage collection, described in the Project Zero blog post <a class="ykcrMYlEiJ-c261" href="https://googleprojectzero.blogspot.com/2022/03/racing-against-clock-hitting-tiny.html">Racing against the clock -- hitting a tiny kernel race window</a>. \<h1 class="ykcrMYlEiJ-c30 ykcrMYlEiJ-c20" id="h.4yx7dnb7u7k1">Part I Conclusion</h1> To recap, we have discussed the kernel internals of SCM_RIGHTS and the designs and implementations of the Linux kernel garbage collector. Besides, we have analyzed the behavior of MSG_PEEK flag with the recvmsg syscall and how it leads to a kernel UAF by a subtle and arcane race condition. The bug was spotted in 2016 publicly, but unfortunately the Linux kernel community did not accept the patch at that time. Any threat actors who saw the public email thread may have a chance to develop an LPE exploit against the Linux kernel. In part two, we'll look at how the vulnerability was exploited and the functionalities of the post compromise modules. <div style='clear: both;'></div> </div> <div class='post-footer'> <div class='post-footer-line post-footer-line-1'> Posted by <meta content='https://www.blogger.com/profile/08975904405228580347' itemprop='url'/> <a class='g-profile' href='https://www.blogger.com/profile/08975904405228580347' rel='author' title='author profile'> Google Project Zero </a> at <meta content='https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html' itemprop='url'/> <a class='timestamp-link' href='https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html' rel='bookmark' title='permanent link'><abbr class='published' itemprop='datePublished' title='2022-08-10T16:00:00-07:00'>4:00 PM</abbr></a> <a href='https://www.blogger.com/post-edit.g?blogID=4838136820032157985&postID=6481767562526230244&from=pencil' title='Edit Post'> <img alt='' class='icon-action' height='18' src='https://resources.blogblog.com/img/icon18_edit_allbkg.gif' width='18'/> </a> <div class='post-share-buttons goog-inline-block'> <a class='goog-inline-block share-button sb-email' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=6481767562526230244&target=email' target='_blank' title='Email This'>Email This</a><a class='goog-inline-block share-button sb-blog' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=6481767562526230244&target=blog' onclick='window.open(this.href, "_blank", "height=270,width=475"); return false;' target='_blank' title='BlogThis!'>BlogThis!</a><a class='goog-inline-block share-button sb-twitter' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=6481767562526230244&target=twitter' target='_blank' title='Share to X'>Share to X</a><a class='goog-inline-block share-button sb-facebook' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=6481767562526230244&target=facebook' onclick='window.open(this.href, "_blank", "height=430,width=640"); return false;' target='_blank' title='Share to Facebook'>Share to Facebook</a><a class='goog-inline-block share-button sb-pinterest' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=6481767562526230244&target=pinterest' target='_blank' title='Share to Pinterest'>Share to Pinterest</a> </div> </div> <div class='post-footer-line post-footer-line-2'> </div> <div class='post-footer-line post-footer-line-3'> </div> </div> </div> <div class='comments' id='comments'> <a name='comments'></a> <h4>No comments:</h4> <div id='Blog1_comments-block-wrapper'> <dl class='avatar-comment-indent' id='comments-block'> </dl> </div> <div class='comment-form'> <a name='comment-form'></a> <h4 id='comment-post-message'>Post a Comment</h4> <a href='https://www.blogger.com/comment/frame/4838136820032157985?po=6481767562526230244&hl=en' id='comment-editor-src'></a> <iframe allowtransparency='true' class='blogger-iframe-colorize blogger-comment-from-post' frameborder='0' height='410px' id='comment-editor' name='comment-editor' src='' width='100%'></iframe> <script src='https://www.blogger.com/static/v1/jsbin/3061944402-comment_from_post_iframe.js' type='text/javascript'></script> <script type='text/java '> BLOG_CMT_createIframe('https://www.blogger.com/rpc_relay.html'); </script> </div> </div> </div> </div></div> </div> <div class='blog-pager' id='blog-pager'> <a class='blog-pager-newer-link' href='https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html' id='Blog1_blog-pager-newer-link' title='Newer Post'>Newer Post</a> <a class='blog-pager-older-link' href='https://googleprojectzero.blogspot.com/2022/06/2022-0-day-in-wild-exploitationso-far.html' id='Blog1_blog-pager-older-link' title='Older Post'>Older Post</a> <a class='home-link' href='https://googleprojectzero.blogspot.com/'>Home</a> </div> <div class='clear'></div> <div class='post-feeds'> <div class='feed-links'> Subscribe to: <a class='feed-link' href='https://googleprojectzero.blogspot.com/feeds/6481767562526230244/comments/default' target='_blank' type='application/atom+xml'>Post Comments (Atom)</a> </div> </div> </div></div> </div> </div> <div class='column-left-outer'> <div class='column-left-inner'> <aside> </aside> </div> </div> <div class='column-right-outer'> <div class='column-right-inner'> <aside> <div class='sidebar section' id='sidebar-right-1'><div class='widget BlogSearch' data-version='1' id='BlogSearch1'> <h2 class='title'>Search This Blog</h2> <div class='widget-content'> <div id='BlogSearch1_form'> <form action='https://googleprojectzero.blogspot.com/search' class='gsc-search-box' target='_top'> <table cellpadding='0' cellspacing='0' class='gsc-search-box'> <tbody> <tr> <td class='gsc-input'> <input autocomplete='off' class='gsc-input' name='q' size='10' title='search' type='text' value=''/> </td> <td class='gsc-search-button'> <input class='gsc-search-button' title='search' type='submit' value='Search'/> </td> </tr> </tbody> </table> </form> </div> </div> <div class='clear'></div> </div><div class='widget PageList' data-version='1' id='PageList1'> <h2>Pages</h2> <div class='widget-content'> <ul> <li> <a href='https://googleprojectzero.blogspot.com/p/about-project-zero.html'>About Project Zero</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/working-at-project-zero.html'>Working at Project Zero</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/0day.html'>0day "In the Wild"</a> </li> <li> <a href='https://googleprojectzero.github.io/0days-in-the-wild/rca.html'>0day Exploit Root Cause Analyses</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html'>Vulnerability Disclosure FAQ</a> </li> </ul> <div class='clear'></div> </div> </div><div class='widget BlogArchive' data-version='1' id='BlogArchive1'> <h2>Archives</h2> <div class='widget-content'> <div id='ArchiveList'> <div id='BlogArchive1_ArchiveList'> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2025/'> 2025 </a> (2) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2025/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/'> 2024 </a> (12) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/12/'> December </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/04/'> April </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/'> 2023 </a> (11) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/08/'> August </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate expanded'> <a class='toggle' href='javascript:void(0)'> ▼  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/'> 2022 </a> (17) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/11/'> November </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate expanded'> <a class='toggle' href='javascript:void(0)'> ▼  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/08/'> August </a> (1) <ul class='posts'> <li><a href='https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html'>The quantum state of Linux kernel garbage collecti...</a></li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/02/'> February </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/'> 2021 </a> (24) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/10/'> October </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/06/'> June </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/02/'> February </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/01/'> January </a> (10) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/'> 2020 </a> (36) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/09/'> September </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/08/'> August </a> (5) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/07/'> July </a> (8) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/06/'> June </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/02/'> February </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/01/'> January </a> (5) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/'> 2019 </a> (27) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/08/'> August </a> (11) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/02/'> February </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/'> 2018 </a> (22) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/12/'> December </a> (7) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/10/'> October </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/08/'> August </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/06/'> June </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/'> 2017 </a> (19) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/10/'> October </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/08/'> August </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/04/'> April </a> (6) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/02/'> February </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/'> 2016 </a> (17) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/03/'> March </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/02/'> February </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/'> 2015 </a> (33) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/09/'> September </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/08/'> August </a> (6) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/07/'> July </a> (5) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/06/'> June </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/02/'> February </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/'> 2014 </a> (11) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/08/'> August </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/07/'> July </a> (3) </li> </ul> </li> </ul> </div> </div> <script type='text/javascript'> //<![CDATA[ (function(){ let archive_list = document.getElementById('ArchiveList'); if (archive_list == null) return; let cur_year = archive_list.querySelector('.post-count-link').innerText.trim() - 0; let last_year = 2014; let elements = []; const MONTHS = ',Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec'.split(','); let parent = document.getElementById('ArchiveList'); while (parent.childNodes.length) parent.removeChild(parent.childNodes[0]); function fetch_next_year() { let url = 'https://googleprojectzero.blogspot.com/?action=getTitles&widgetId=BlogArchive1&widgetType=BlogArchive&responseType=js&path=https%3A%2F%2Fgoogleprojectzero.blogspot.com%2F'+cur_year; fetch(url).then(resp => { if (!resp.ok) { console.log('http error'); return; } resp.text().then(text => { let scope = { _WidgetManager: { _HandleControllerResult: (name, method, results) => { elements.push(document.createElement('hr')); let year_header = document.createElement('div'); year_header.appendChild(document.createTextNode(cur_year)); year_header.style.fontSize = 'large'; elements.push(year_header); let list = document.createElement('ul'); elements.push(list); for (let obj of results.posts) { let link_parts = obj.url.split('/'); let year = link_parts[3]; let month = link_parts[4]; let el = document.createElement(/*'div'*/'li'); el.style.listStyleType = 'square'; el.style.listStylePosition = 'inside'; let link = document.createElement('a'); el.appendChild(link); link.appendChild(document.createTextNode(obj.title)); link.href = obj.url; let date_trailer = document.createElement('span'); el.appendChild(date_trailer); //date_trailer.appendChild(document.createTextNode(' ('+year+'-'+month+')')); date_trailer.appendChild(document.createTextNode(' ('+MONTHS[parseInt(month, 10)]+')')); //date_trailer.style.textAlign = 'right'; //elements.push(el); list.appendChild(el); } } } }; with (scope) { eval(text); } if (cur_year == last_year) { finish(); } else { cur_year--; fetch_next_year(); } }); }); } fetch_next_year(); function finish() { for (let obj of elements) { parent.appendChild(obj); } console.log(elements); } })(); //]]> </script> <div class='clear'></div> </div> </div></div> <table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'> <tbody> <tr> <td class='first columns-cell'> <div class='sidebar no-items section' id='sidebar-right-2-1'></div> </td> <td class='columns-cell'> <div class='sidebar no-items section' id='sidebar-right-2-2'></div> </td> </tr> </tbody> </table> <div class='sidebar no-items section' id='sidebar-right-3'></div> </aside> </div> </div> </div> <div style='clear: both'></div>  </div>  </div> </div> <div class='main-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <footer> <div class='footer-outer'> <div class='footer-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left footer-fauxborder-left'> <div class='fauxborder-right footer-fauxborder-right'></div> <div class='region-inner footer-inner'> <div class='foot no-items section' id='footer-1'></div> <table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'> <tbody> <tr> <td class='first columns-cell'> <div class='foot no-items section' id='footer-2-1'></div> </td> <td class='columns-cell'> <div class='foot no-items section' id='footer-2-2'></div> </td> </tr> </tbody> </table>  <div class='foot section' id='footer-3' name='Footer'><div class='widget Attribution' data-version='1' id='Attribution1'> <div class='widget-content' style='text-align: center;'> Powered by <a href='https://www.blogger.com' target='_blank'>Blogger</a>. </div> <div class='clear'></div> </div></div> </div> </div> <div class='footer-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </footer>  </div> </div> <div class='content-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <script type='text/javascript'> window.setTimeout(function() { document.body.className = document.body.className.replace('loading', ''); }, 10); </script> <script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/688949419-widgets.js"></script> <script type='text/javascript'> window['__wavt'] = 'AOuZoY7c2_o-IP2_AB2euQmzd5Y7FB-SBg:1739851407703';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d4838136820032157985','//googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html','4838136820032157985'); _WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '4838136820032157985', 'title': 'Project Zero', 'url': 'https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html', 'canonicalUrl': 'https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html', 'homepageUrl': 'https://googleprojectzero.blogspot.com/', 'searchUrl': 'https://googleprojectzero.blogspot.com/search', 'canonicalHomepageUrl': 'https://googleprojectzero.blogspot.com/', 'blogspotFaviconUrl': 'https://googleprojectzero.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-240546891-1', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Project Zero - RSS\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/4838136820032157985/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/6481767562526230244/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/f6e0cc369f0f1a05', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '6481767562526230244', 'postImageThumbnailUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s72-c/image71.png', 'postImageUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s1200/image71.png', 'pageName': 'The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)', 'pageTitle': 'Project Zero: The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': false, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)', 'description': ' A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest...', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNWAkA0RVb4goO21_FhJOVV-LSNTfbXV7GKoqH-CUrdMTpDcNUSQxEssrnAVGxC50aK-Z3HfIWeDyCgkr6lb5-a1Ha9Km5ppaHeBzWmLj8NTmZtUjx8J-VzzM1O7mYdjOfw2ErddrslDXw6rDZrs0g1DEC1Ya4VAbkLKKEhZgNPeiSefH-xpv3zDa8/s1200/image71.png', 'url': 'https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 6481767562526230244}}]); _WidgetManager._RegisterWidget('_NavbarView', new _WidgetInfo('Navbar1', 'navbar', document.getElementById('Navbar1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'header', document.getElementById('Header1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1360229384-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/1964470060-lightbox_bundle.css'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch1', 'sidebar-right-1', document.getElementById('BlogSearch1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList1', 'sidebar-right-1', document.getElementById('PageList1'), {'title': 'Pages', 'links': [{'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/about-project-zero.html', 'id': '4384467920505278144', 'title': 'About Project Zero'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/working-at-project-zero.html', 'id': '2459334498880008057', 'title': 'Working at Project Zero'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/0day.html', 'id': '3414239791814532209', 'title': '0day \x22In the Wild\x22'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.github.io/0days-in-the-wild/rca.html', 'title': '0day Exploit Root Cause Analyses'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html', 'id': '2935252455704572784', 'title': 'Vulnerability Disclosure FAQ'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogArchiveView', new _WidgetInfo('BlogArchive1', 'sidebar-right-1', document.getElementById('BlogArchive1'), {'languageDirection': 'ltr', 'loadingMessage': 'Loading\x26hellip;'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_AttributionView', new _WidgetInfo('Attribution1', 'footer-3', document.getElementById('Attribution1'), {}, 'displayModeFull')); </script> </body> </html>