Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Firecracker serial console emulation may allocate an unbounded amount of memory #2177

Closed
sandreim opened this issue Oct 14, 2020 · 1 comment · Fixed by #2235
Closed

Firecracker serial console emulation may allocate an unbounded amount of memory #2177

sandreim opened this issue Oct 14, 2020 · 1 comment · Fixed by #2235
Assignees
@sandreim
Labels
Priority: High Indicates than an issue or pull request should be resolved ahead of issues or pull requests labelled Type: Bug Indicates an unexpected problem or unintended behavior

Comments

@sandreim
Copy link
Contributor

sandreim commented Oct 14, 2020 •
edited
Loading

We have identified an issue in the Firecracker serial console emulation of all Firecracker versions up to v0.21.2 and Firecracker v0.22.0

Issue Description

The Firecracker implementation of the serial console emulation allows buffering of an unlimited number of bytes when data is written to the Firecracker process standard input at a high rate.

Impact

Firecracker customers that forward the standard input of the Firecracker process to untrusted users can become subject to DoS attacks. If memory limits are not imposed on the Firecracker process, this might impair other microVMs on the same host from allocating memory, potentially becoming an availability issue.

Serial output generated by the guest can’t trigger the issue.

Affected Systems

Firecracker versions v0.22.0 and v0.21.2, while all older releases might be impacted.

Mitigation

Impact can be mitigated by applying memory limits to the Firecracker process or by applying a rate limit when writing to the Firecracker process standard input.

Customers may apply:
Patched binaries mitigating this issue have been released as Firecracker v0.21.3[1] and Firecracker v0.22.1[2].
If you are using Firecracker versions up to v0.21.2 or Firecracker v0.22.0, we recommend you apply the provided fix.

[1] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.21.3
[2] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.22.1
@sandreim sandreim added Type: Bug Indicates an unexpected problem or unintended behavior Priority: High Indicates than an issue or pull request should be resolved ahead of issues or pull requests labelled labels Oct 14, 2020
@sandreim sandreim self-assigned this Oct 14, 2020
This was referenced Oct 14, 2020
Merged
Merged
@alindima alindima mentioned this issue Oct 15, 2020
Merged
9 tasks
@alindima alindima mentioned this issue Oct 28, 2020
Merged
9 tasks
@alindima alindima linked a pull request Oct 28, 2020 that will close this issue
Cherry-pick v0.23.0 commits #2235
Merged
9 tasks
@alindima
Copy link
Contributor

Issue was fixed in v0.22.1, v0.21.3 and v0.23.0. Closing this issue after adding the fix in mainline.

@amshinde amshinde mentioned this issue Dec 3, 2020
Closed
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 3, 2020
@amshinde
versions: Update firecracker to 0.23.1
37f865f 
In addition to features related to gathering metrics around
several data-points, the releases leading to this release
carry a few secirty fixes.
Lets update to latest fircracker release.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
@amshinde amshinde mentioned this issue Dec 3, 2020
Merged
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 9, 2020
@amshinde
versions: Update firecracker to 0.21.3
11c8c19 
Release included important security updates.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 9, 2020
@amshinde
versions: Update firecracker to 0.21.3
e77376a 
Release included important security updates.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
(cherry picked from commit 11c8c19)
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 9, 2020
@amshinde
versions: Update firecracker to 0.21.3
5ae8257 
Release included important security updates.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
(cherry picked from commit 11c8c19)
This was referenced Dec 9, 2020
Merged
Merged
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 11, 2020
@amshinde
versions: Update firecracker to 0.21.3
ae09b73 
Release included important security updates.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095
Depends-on: github.com/kata-containers/osbuilder#508

(cherry picked from commit 11c8c19)
Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 11, 2020
@amshinde
versions: Update firecracker to 0.21.3
201bc7d 
Release included important security updates.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095
Depends-on: github.com/kata-containers/osbuilder#508

(cherry picked from commit 11c8c19)
Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
amshinde added a commit to amshinde/kata-runtime that referenced this issue Dec 23, 2020
@amshinde
versions: Update firecracker to 0.21.3
7b2c296 
Release included important security updates.

References:
firecracker-microvm/firecracker#2057
firecracker-microvm/firecracker#2177

Fixes: kata-containers#3095

(cherry picked from commit 11c8c19)
Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sandreim sandreim

Labels
Priority: High Indicates than an issue or pull request should be resolved ahead of issues or pull requests labelled Type: Bug Indicates an unexpected problem or unintended behavior
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Cherry-pick v0.23.0 commits alindima/firecracker
2 participants
@alindima @sandreim