bugThe GNU Hurd - Bugs: bug #48456, mig-generated user code does not...


bug #48456: mig-generated user code does not destroy invalid reply

Submitter:  Kalle Olavi Niemitalo <kon>
Submitted:  Sun 10 Jul 2016 11:56:21 AM UTC
Category:  GNU MIG Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Reproducibility:  Every Time
Size (loc):  None Planned Release:  None
Effort:  0.00
Wiki-like text discussion box: 

* Mandatory Fields

Add a New Comment Rich Markup

Wed 31 Aug 2016 10:35:59 PM UTC, comment #1: 

I wrote: "This could perhaps be used for denial of service, if a long-lived process calls a less-trusted one."

The exec server is a long-lived process, and it calls several RPC routines on the FILE and OLDTASK passed to exec_exec, which can be called by anyone.  That makes it vulnerable to the DoS.  I don't currently have a test case for that.

Kalle Olavi Niemitalo <kon>
Sun 10 Jul 2016 11:56:21 AM UTC, original submission:  

If "user" code generated by MIG sends a request to a server and gets back a reply that does not match the RPC definition, then it returns an error but does not destroy the reply message.  So if the reply carried any rights to ports, then those rights will remain in the task.  This could perhaps be used for denial of service, if a long-lived process calls a less-trusted one.

The attached reply-leak.tar.gz demonstrates this bug.  In it, a program first forks and the child process then does an RPC to the parent once per second, but the parent process replies with a message that has an unexpected msgh_id and carries ten receive rights instead of the required data.  In the child process, MIG-generated code detects this mismatch and returns an error, which the child process logs.  The child process then checks how many port names it has, and logs that value, which increases by ten per second.  It should not increase.

Kalle Olavi Niemitalo <kon>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #37791:  reply-leak.tar.gz added by kon (2KiB - application/gzip - test case)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by kon (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-07-10 kon Attached File- Added reply-leak.tar.gz, #37791

    Back to the top

    Powered by Savane 3.13-04b1.
    Corresponding source code