DataSCon: Verified and Reproducible System-Level Concurrency Bugs

DataSCon: Verified and Reproducible System-Level Concurrency Bugs In this project, we provide a dataset to support a systematic approach to reproduce and localize concurrency bugs in system-level software. The project includes: Detailed reproduction steps Pin tool for monitoring system calls Analysis of available information Code references for affected components Dataset Structure The dataset lives under bugs/, organized by the bug tracker the report originates from. Each bug has its own self-contained folder named after its tracker ID: bugs/<tracker>/<bug-id>/ The dataset contains **66 bugs** across four trackers: | Tracker | Folder | Bug ID references | | --- | --- | --- | --- | | Red Hat Bugzilla | [bugs/bugzilla/](bugs/bugzilla/) | `bugzilla.redhat.com` bug numbers | | Debian | [bugs/debian/](bugs/debian/) | `bugs.debian.org` bug numbers | | GNU (debbugs) | [bugs/gnu/](bugs/gnu/) | `debbugs.gnu.org` bug numbers | | GNU Savannah | [bugs/gnu-savannah/](bugs/gnu-savannah/) | `savannah.gnu.org` bug numbers | The bugs span a range of system-level software, including coreutils, bzip2, logrotate, glibc, pxz, libuser, wget, findutils, bash, gcc, and lpr. The repository also contains supporting material outside `bugs/`: [components/](components/) (vendored source of affected programs), [input-generation/](input-generation/) (input/test generation helpers), and [automations/](automations/) (workflow automation). Per-Bug Artifacts In its modern form, each bug folder packages everything needed to build, reproduce, and trace the bug in an isolated container. The four core artifacts are described below; [bugs/debian/303300/](bugs/debian/303300/) (bzip2 TOCTOU, CVE-2005-0953) is used as the reference example. Dockerfile Builds an Ubuntu-based image that reproduces the bug in isolation. It installs build/trace tooling, compiles the vulnerable program **with debug symbols** (`-g -O0`) so source-line backtraces are available, and downloads and builds Intel Pin together with the folder's `pintool.cpp` into a loadable `.so`. Reference: [bugs/debian/303300/Dockerfile](bugs/debian/303300/Dockerfile). docker-compose.yml Defines the reproduction service so a single command brings the environment up. It bind-mounts the bug folder into the container at `/workspace`, runs privileged, and keeps the container alive (`sleep infinity`) so the reproduction script can be run from an interactive shell inside it. Reference: [bugs/debian/303300/docker-compose.yml](bugs/debian/303300/docker-compose.yml). pintool.cpp An Intel Pin instrumentation tool that hooks the system calls involved in the race. For a TOCTOU bug it typically marks the start of the race window on `openat`+`O_CREAT` ("Race window opened") and its end on `chmod` ("Race window closed"), logging syscall numbers and source-level backtraces to a trace file. It also widens the otherwise tiny race window with a deliberate delay so the exploit can win the race reliably. Behavior is configurable via knobs such as `-trace_file` and `-target_name`. Reference: [bugs/debian/303300/pintool.cpp](bugs/debian/303300/pintool.cpp). repro.sh A self-contained driver script that reproduces the bug end to end: it sets up the target and victim files, launches the Pin-instrumented program, watches its output for the race-window signal, performs the exploit action during the window (e.g. a hardlink swap), and finally verifies the outcome by comparing before/after state and printing whether the race was exploited. Reference: [bugs/debian/303300/repro.sh](bugs/debian/303300/repro.sh). Companion files Most folders also include a per-bug `README.md` with the full write-up (affected versions, syscalls, code references, expected output), trace outputs (`trace.txt` / `repro.out`), and `strace.sh` capturing the expected (non-exploited) syscall sequence as a baseline. Older bugs may differ: some use `exploit.sh` in place of `repro.sh`, `compose.yml` in place of `docker-compose.yml` (e.g. [bugs/bugzilla/1065574-glibc/compose.yml](bugs/bugzilla/1065574-glibc/compose.yml)), or ship a pinned source tarball (e.g. `logrotate-3.7.8.tar.gz`) instead of fetching the source in the `Dockerfile`. How to Reproduce a Bug Each bug is reproduced inside its own container: ```bash cd bugs/<tracker>/<bug-id> docker compose up -d --build # build the image and start the container docker compose exec -it <service> bash # open a shell inside the container # then, inside the container: cd /workspace && ./repro.sh ``` The exact service name and any bug-specific details are documented in that bug's own `README.md`. Redhat Bugzilla SN Bug ID Target Pair System Call File Buggy Loc. 1, 2 155758, 155760 mkdir -m 400 foo rm -rf foo; ln -s bar foo mkdir(83); chmod(90) mkdir.c main; 161:189 3 438076 mv bar foo cat foo unlink(87); rename(82) copy.c copy_internal: 1295; 1426 4, 5 1141368, 1166570 mv a b mv b a lstat(6); unlink(87) copy.c copy_internal: 1807; 1887 6 1182024 pxz foo ls -l foo.xz openat(257); chmod(90) pxz.c main: 300, 442 7 1211300 rm -rf foo cd foo; mv bar/ bar.bak; ln -s ../qux bar newfstatat(262); openat(257) fts.c fts_build; 306, 309 8, 9 155742, 155744 bzip2 -d foo.txt.bz2 rm foo.txt; ln bar.txt foo.txt openat(257); chmod(90) bzip2.c fopen_output_safely; 1043, applySavedMetaInfoTo...; 1137 10, 11, 12 155745, 155746, 157696 gzip -d foo.gz rm foo; ln -s bar foo openat(257); chmod(90) gzip.c create_outfile: 879; copy_stat: 1627 13 680798 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(91) logrotate.c createOutputFile: 192; 198 14 847339 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(91) logrotate.c createOutputFile: 192; 198 15, 16 1532284, 1532285 chown -R -L user:user foo ln -s -f bar foo/baz/qux stat(4); fchownat(260) chown-core.c 84; 98 17, 18 680789, 680790 logrotate -f config.conf ln -sf target /path/to/log openat(257); fchmod(91)/fchown logrotate.c createOutputFile: 192; 198 19, 20 157498, 157499 wget /url/to/foo ln -sf bar foo openat(257); write(1) 21 45647 logrotate -f config.conf logrotate -f config.conf openat(257); rename(82) logrotate.c prerotateSingleLog: 950 22 680787 logrotate -f config.conf cat /var/log/testapp/app.log logrotate.c 23, 24 2232278, 2232514 find f -ignore_readdir_race -type d rmdir f/dir newfstatat(262); openat(257) fts.c, openat-safer.c fts_stat: 1819; openat_safer: 45 25 884685 luserdel -r username rm -rf foo/sub; ln -s bar foo/sub lstat(6); openat(257) apputil.c lu_homedir_remove: 383; 357 26, 27 2222604, 2223893 curl -c foo /url/to/foo rm -f foo; ln -s bar foo stat(4); openat(257) 28 711642 bash touch file{1..10000}.txt keyboard interrupt - - - 29 517321 logrotate -f logrotate.conf anacron -s -d - - - GNU SN Bug ID Target Pair System Call File Buggy Loc. 1 18499 ln foo bar; mv a b mv b a lstat(6); unlink(87) copy.c copy_internal; 1807, 1887 2 23539 tail -F foo mv bar foo inotify_add_watch(254); read(0) tail.c 1208; 1222 3 25342 ln -f src dest cat dest linkat(265); unlinkat(87) ln.c 305; 330 4 13352 cp -pPR foo bar seq 4 | cp -pPR foo bar mkdir; write copy.c 2156; 2158 5 45371 rm -rf --preserve-root=all --one-file-system dfoo bindfs --no-allow-other dbar dfoo stat(4); unlinkat(263) fts.c, remove.c 310 (fts.c); 370 (remove.c) 6, 7, 8 32772, 11108, 18280 chmod -R u=u /tmp/a mv /tmp/a/b/c noc; ln -s bar /tmp/a/b/c fchmodat(268); openat(257) chmod.c main: 273; 373 9, 10 11100, 11074 cp source dest rm dest stat(6); openat(257) copy.c, open_safer.c copy_internal: 1661; open_safer: 45 11 25680 cp -afl a b seq 2 | cp -afl a b lstat(6); linkat(265) copy.c 1789; 1795 12, 13 45930(s), 26349(s) find f -ignore_readdir_race -type d rmdir f/dir newfstatat(262); openat(257) fts.c, openat-safer.c fts_stat: 1819; openat_safer: 45 14 33096 ln foo bar touch bar lstat(6); linkat(265) ln.c do_link: 196; 328 15, 16 29961, 30907 mv -n foo bar chmod 000 bar lstat(6); rename(82) copy.c copy_internal: 1921; 2329 17 61105 cp -n foo bar chmod 777 bar openat(257); copy_file_range(326) copy.c copy_internal: 1443; 1585 18 12947 install -m 0600 foo bar cat bar openat(257); chmod(90) install.c install_file_in_file: 740; 807 19 47380 install -c -m 0755 foo bar chmod 000 bar openat(257); write(1) copy.c copy_internal: 1120; 1294 20 22057(s) updatedb --output=/path/to/db locate -d /path/to/db unlink(87); rename(82) updatedb.sh 21 10679 mv --backup=t bar foo cat foo rename(82); rename(82) copy.c copy_internal: 1512; 1713 22 51793 env timeout --verbose --kill-after=.1 --signal=INT .1 env --ignore-signal sleep 10 no need - - - 23 34713 mv a /t/ae mv b/* a - - - 24 21460 tail --follow=foo cat foo - - - Debian SN Bug ID Target Pair System Call File Buggy Loc. 1 775306 pxz foo ls -l foo.xz openat(257); chmod(90) pxz.c main: 300, 443 2 304556 mkdir -m 400 foo ls -l foo.xz mkdir(83); chmod(90) mkdir.c main; 162, 190 3 841371 install -o myuser -m 0777 foo bar ln -s bar victim openat(257); lchown(94)/chmod(90) install.c install_file_in_file; 690; 484/486 4 303300 bzip2 -d foo.txt.bz2 rm foo; ln bar foo openat(257); chmod(90) bzip2.c fopen_output_safely; 1043, applySavedMetaInfoToOutputFile; 1137 5 56386 bzip2 foo rm foo.bz2; ln bar foo.bz2 openat(257); chmod(90) bzip2.c compress; 998, copyDatePermissionsAndOwner; 837 6 303927 gzip foo; gzip -d foo.gz rm -f foo; ln bar.txt foo openat(257); chmod(90) gzip.c create_outfile: 930; copy_stat: 1728 7 548439 tail -F foo mv bar foo inotify_add_watch(254); read(0) tail.c 1208; 1222 8 283702 seq 3 | bash -i no need openat(257); write(1) histfile.c 9 461585 updatedb --output=/path/to/db locate -d /path/to/db unlink(87); rename(82) updatedb.sh 10 357140 ln -sf foo bar rm -f bar symlink(88); unlink(87) ln.c do_link: 287; 310 11 500395 wget -nc /url/to/file wget -nc /url/to/file; wget -nc /url/to/file stat(4); openat(257) utils.c, http.c main 12 836503 wget -r -nH -A '*.jpg' /url/to/malicious.php cat malicious.php openat(257); unlink(87) http.c, recur.c 2927; 436 13 67782 find dfoo -ls rm -f dfoo/bar getdents64(217); newfstatat(262) 14 308622 wget -P /path/to/dir /url/to/file ln -sf target_file newfstatat(262); openat(257) http.c utils.c: 567; http.c: 2582 15 388608 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(90) logrotate.c createOutputFile: 192; 198 16 400198 logrotate -f config.conf ls -la /var/log/testapp/app.log openat(257); fchown(93) logrotate.c createOutputFile: 192; 203 17 639302 logrotate -f config.conf cat /var/log/testapp/app.log openat(257); fchmod(90) logrotate.c createOutputFile: 192; 198 18 321927 unzip -o target.zip -d output ln target /exploit/output/secret.txt close(3); chmod(90) unix.c close_outfile: 1249; 1268 19 624219 - - -