From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Stefan Hajnoczi <stefanha@redhat.com> Cc: mszeredi@redhat.com, Daniel Berrange <berrange@redhat.com>, slp@redhat.com, qemu-devel@nongnu.org, P J P <ppandit@redhat.com>, virtio-fs@redhat.com, Greg Kurz <groug@kaod.org>, Alex Xu <alex@alxu.ca>, Laszlo Ersek <lersek@redhat.com>, vgoyal@redhat.com Subject: Re: [PATCH v5 0/3] virtiofsd: prevent opening of special files (CVE-2020-35517) Date: Thu, 4 Feb 2021 18:14:17 +0000 [thread overview] Message-ID: <20210204181417.GN3039@work-vm> (raw) In-Reply-To: <20210204150208.367837-1-stefanha@redhat.com> * Stefan Hajnoczi (stefanha@redhat.com) wrote: > v4: > * Patch 1: Return positive errno if openat(2) fails in lo_do_open() [Greg] > * Patch 3: Return -fd instead or -errno after lo_inode_open() in lo_do_open() [Greg] > * Patch 3: Use De Morgan's Law to simplify the boolean expression in lo_create() [Vivek] > * Patch 3: Add missing errno = -truncfd after lo_inode_open() call in lo_setattr > v3: > * Restructure lo_create() to handle externally-created files (we need > to allocate an inode for them) [Greg] > * Patch 1 & 2 refactor the code so that Patch 3 can implement the CVE fix > v3: > * Protect lo_create() [Greg] > v2: > * Add doc comment clarifying that symlinks are traversed client-side > [Daniel] > > A well-behaved FUSE client does not attempt to open special files with > FUSE_OPEN because they are handled on the client side (e.g. device nodes > are handled by client-side device drivers). > > The check to prevent virtiofsd from opening special files is missing in > a few cases, most notably FUSE_OPEN. A malicious client can cause > virtiofsd to open a device node, potentially allowing the guest to > escape. This can be exploited by a modified guest device driver. It is > not exploitable from guest userspace since the guest kernel will handle > special files inside the guest instead of sending FUSE requests. > > This patch series fixes this issue by introducing the lo_inode_open() function > to check the file type before opening it. This is a short-term solution because > it does not prevent a compromised virtiofsd process from opening device nodes > on the host. > > This issue was diagnosed on public IRC and is therefore already known > and not embargoed. > > Reported-by: Alex Xu <alex@alxu.ca> > Fixes: CVE-2020-35517 Queued > Stefan Hajnoczi (3): > virtiofsd: extract lo_do_open() from lo_open() > virtiofsd: optionally return inode pointer from lo_do_lookup() > virtiofsd: prevent opening of special files (CVE-2020-35517) > > tools/virtiofsd/passthrough_ll.c | 224 ++++++++++++++++++++----------- > 1 file changed, 148 insertions(+), 76 deletions(-) > > -- > 2.29.2 > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
WARNING: multiple messages have this Message-ID (diff)
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Stefan Hajnoczi <stefanha@redhat.com> Cc: Daniel Berrange <berrange@redhat.com>, qemu-devel@nongnu.org, P J P <ppandit@redhat.com>, virtio-fs@redhat.com, Alex Xu <alex@alxu.ca>, Laszlo Ersek <lersek@redhat.com>, vgoyal@redhat.com Subject: Re: [Virtio-fs] [PATCH v5 0/3] virtiofsd: prevent opening of special files (CVE-2020-35517) Date: Thu, 4 Feb 2021 18:14:17 +0000 [thread overview] Message-ID: <20210204181417.GN3039@work-vm> (raw) In-Reply-To: <20210204150208.367837-1-stefanha@redhat.com> * Stefan Hajnoczi (stefanha@redhat.com) wrote: > v4: > * Patch 1: Return positive errno if openat(2) fails in lo_do_open() [Greg] > * Patch 3: Return -fd instead or -errno after lo_inode_open() in lo_do_open() [Greg] > * Patch 3: Use De Morgan's Law to simplify the boolean expression in lo_create() [Vivek] > * Patch 3: Add missing errno = -truncfd after lo_inode_open() call in lo_setattr > v3: > * Restructure lo_create() to handle externally-created files (we need > to allocate an inode for them) [Greg] > * Patch 1 & 2 refactor the code so that Patch 3 can implement the CVE fix > v3: > * Protect lo_create() [Greg] > v2: > * Add doc comment clarifying that symlinks are traversed client-side > [Daniel] > > A well-behaved FUSE client does not attempt to open special files with > FUSE_OPEN because they are handled on the client side (e.g. device nodes > are handled by client-side device drivers). > > The check to prevent virtiofsd from opening special files is missing in > a few cases, most notably FUSE_OPEN. A malicious client can cause > virtiofsd to open a device node, potentially allowing the guest to > escape. This can be exploited by a modified guest device driver. It is > not exploitable from guest userspace since the guest kernel will handle > special files inside the guest instead of sending FUSE requests. > > This patch series fixes this issue by introducing the lo_inode_open() function > to check the file type before opening it. This is a short-term solution because > it does not prevent a compromised virtiofsd process from opening device nodes > on the host. > > This issue was diagnosed on public IRC and is therefore already known > and not embargoed. > > Reported-by: Alex Xu <alex@alxu.ca> > Fixes: CVE-2020-35517 Queued > Stefan Hajnoczi (3): > virtiofsd: extract lo_do_open() from lo_open() > virtiofsd: optionally return inode pointer from lo_do_lookup() > virtiofsd: prevent opening of special files (CVE-2020-35517) > > tools/virtiofsd/passthrough_ll.c | 224 ++++++++++++++++++++----------- > 1 file changed, 148 insertions(+), 76 deletions(-) > > -- > 2.29.2 > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2021-02-04 18:53 UTC|newest] Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-02-04 15:02 [PATCH v5 0/3] virtiofsd: prevent opening of special files (CVE-2020-35517) Stefan Hajnoczi 2021-02-04 15:02 ` [Virtio-fs] " Stefan Hajnoczi 2021-02-04 15:02 ` [PATCH v5 1/3] virtiofsd: extract lo_do_open() from lo_open() Stefan Hajnoczi 2021-02-04 15:02 ` [Virtio-fs] " Stefan Hajnoczi 2021-02-04 17:08 ` Greg Kurz 2021-02-04 17:08 ` [Virtio-fs] " Greg Kurz 2021-02-04 15:02 ` [PATCH v5 2/3] virtiofsd: optionally return inode pointer from lo_do_lookup() Stefan Hajnoczi 2021-02-04 15:02 ` [Virtio-fs] " Stefan Hajnoczi 2021-02-04 15:02 ` [PATCH v5 3/3] virtiofsd: prevent opening of special files (CVE-2020-35517) Stefan Hajnoczi 2021-02-04 15:02 ` [Virtio-fs] " Stefan Hajnoczi 2021-02-04 17:12 ` Greg Kurz 2021-02-04 16:15 ` [PATCH v5 0/3] " no-reply 2021-02-04 16:15 ` [Virtio-fs] " no-reply 2021-02-04 17:35 ` Dr. David Alan Gilbert 2021-02-04 17:35 ` [Virtio-fs] " Dr. David Alan Gilbert 2021-02-04 18:14 ` Dr. David Alan Gilbert [this message] 2021-02-04 18:14 ` Dr. David Alan Gilbert
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210204181417.GN3039@work-vm \ --to=dgilbert@redhat.com \ --cc=alex@alxu.ca \ --cc=berrange@redhat.com \ --cc=groug@kaod.org \ --cc=lersek@redhat.com \ --cc=mszeredi@redhat.com \ --cc=ppandit@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=slp@redhat.com \ --cc=stefanha@redhat.com \ --cc=vgoyal@redhat.com \ --cc=virtio-fs@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.