Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Firecracker vsock implementation buffer overflow in versions v0.18.0 and v0.19.0 that can result in potentially exploitable crashes. #1462

Closed
acatangiu opened this issue Dec 9, 2019 · 1 comment

Comments

@acatangiu
Copy link
Contributor

We have identified an issue in the Firecracker v0.18.0 and v0.19.0 vsock implementation.

Issue Description

A logical error in bounds checking performed on vsock virtio descriptors can be used by a malicious guest to read from and write to a segment of the host-side Firecracker process' heap address space, directly after the end of a guest memory region. For reads, the accessible segment's size is 64 KiB. For writes, the accessible segment is limited by the host Linux kernel to a size defined in /proc/sys/net/core/rmem_max. We expect the value of rmem_max to be on the order of a few hundred KiB to a few MiB.

Impact

This will generally result in a segmentation fault, but remote code execution within the Firecracker host-side process context cannot be ruled out.

Vulnerable Systems

Only Firecracker v0.18.0 and v0.19.0 are affected. Only Firecracker microVMs with configured vsock devices are affected, and only if one or more vsock devices are in active use by both host and guest.

In a remote code execution scenario, users running Firecracker in line with the recommended Production Host Setup will see the impact limited as follows: a malicious microVM guest that would manage to compromise the Firecracker VMM process would be restricted to running on the host as an unprivileged user, in a chroot and mount namespace isolated from the host's filesystem, in a separate pid namespace, in a separate network namespace, with system calls limited to Firecracker's seccomp whitelist, on a single NUMA node, and on a cgroups-limited number of CPU cores.

Mitigation

Firecracker v0.18.1 [1] and Firecracker v0.19.1 [2], released on 2019-12-09, addresses this issue. The fix has also been applied to Firecracker's master branch.

If you are using Firecracker v0.18.0 or v0.19.0, we recommend you update to v0.18.1 or v0.19.1 as soon as possible. If you are using Firecracker v0.17.0 or below, you do not need to take any action.

In a remote code execution scenario, users running Firecracker in line with the recommended Production Host Setup will limit the impact to the attacker's Firecracker process.

[1] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.18.1
[2] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.19.1

@acatangiu
Copy link
Contributor Author

Fixed in #1459 for master branch, and #1457 and #1458 for the previously affected Firecracker versions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant