From cb3542f76a64eee879ecaece45af310f15c531fb Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 20:40:51 +0000 Subject: [PATCH 1/2] Catch invalid address exception for invalid sock values --- volatility3/framework/plugins/linux/sockstat.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 764c04563..914c251d0 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -538,8 +538,11 @@ class Sockstat(plugins.PluginInterface): continue sock = socket.sk.dereference() - sock_type = sock.get_type() - family = sock.get_family() + try: + sock_type = sock.get_type() + family = sock.get_family() + except exceptions.InvalidAddressException: + continue sock_handler = SockHandlers(vmlinux, task) sock_fields = sock_handler.process_sock(sock) From 4d43ac9a6dc51c6b2855a907b452185d4eb0366a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 20:46:16 +0000 Subject: [PATCH 2/2] Catch invalid address exception for invalid sock values --- volatility3/framework/plugins/linux/sockstat.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 914c251d0..3d2df655b 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -541,11 +541,11 @@ class Sockstat(plugins.PluginInterface): try: sock_type = sock.get_type() family = sock.get_family() + sock_handler = SockHandlers(vmlinux, task) + sock_fields = sock_handler.process_sock(sock) except exceptions.InvalidAddressException: continue - sock_handler = SockHandlers(vmlinux, task) - sock_fields = sock_handler.process_sock(sock) if not sock_fields: continue