bugThe GNU Hurd - Bugs: bug #48456, mig-generated user code does not...

 
 

bug #48456: mig-generated user code does not destroy invalid reply

Submitted by:  Kalle Olavi Niemitalo <kon>
Submitted on:  Sun 10 Jul 2016 11:56:21 AM UTC  
 
Category: GNU MIGSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: OpenReproducibility: Every Time
Size (loc): NonePlanned Release: None
Effort: 0.00
Wiki-like text discussion box: 

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 31 Aug 2016 10:35:59 PM UTC, comment #1:

I wrote: "This could perhaps be used for denial of service, if a long-lived process calls a less-trusted one."

The exec server is a long-lived process, and it calls several RPC routines on the FILE and OLDTASK passed to exec_exec, which can be called by anyone. That makes it vulnerable to the DoS. I don't currently have a test case for that.

Kalle Olavi Niemitalo <kon>
Sun 10 Jul 2016 11:56:21 AM UTC, original submission:

If "user" code generated by MIG sends a request to a server and gets back a reply that does not match the RPC definition, then it returns an error but does not destroy the reply message. So if the reply carried any rights to ports, then those rights will remain in the task. This could perhaps be used for denial of service, if a long-lived process calls a less-trusted one.

The attached reply-leak.tar.gz demonstrates this bug. In it, a program first forks and the child process then does an RPC to the parent once per second, but the parent process replies with a message that has an unexpected msgh_id and carries ten receive rights instead of the required data. In the child process, MIG-generated code detects this mismatch and returns an error, which the child process logs. The child process then checks how many port names it has, and logs that value, which increases by ten per second. It should not increase.

Kalle Olavi Niemitalo <kon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #37791:  reply-leak.tar.gz added by kon (2KiB - application/gzip - test case)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 10 Jul 2016 11:56:22 AM UTCkonAttached File-=>Added reply-leak.tar.gz, #37791

    Back to the top


    Powered by Savane 3.1-cleanup1