jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-31 05:27:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

OPENAFS-SA-2018-003 volser: prevent unbounded input to AFSVolForwardMultiple

Browse Source 
AFSVolForwardMultiple is defined with an input parameter that is defined
to XDR as an unbounded array of replica structs:
  typedef replica manyDests<>;

RPCs with unbounded arrays as inputs are susceptible to remote
denial-of-service (DOS) attacks.  A malicious client may submit an
AFSVolForwardMultiple request with an arbitrarily large array, forcing
the volserver to expend large amounts of network bandwidth, cpu cycles,
and heap memory to unmarshal the input.

Even though AFSVolForwardMultiple requires superuser authorization, this
attack is exploitable by non-authorized actors because XDR unmarshalling
happens long before any authorization checks can occur.

Add a bounding constant (NMAXNSERVERS 13) to the manyDests input array.
This constant is derived from the current OpenAFS vldb implementation, which
is limited to 13 replica sites for a given volume by the layout (size) of the
serverNumber, serverPartition, and serverFlags fields.

[kaduk@mit.edu: explain why this constant is used]

(cherry picked from commit 97b0ee4d9c9d069e78af2e046c7987aa4d3f9844)

(cherry picked from commit fac3749f0d180e0ca229326c0e8568a60e17d3e9)

(cherry picked from commit ea30e64d1b2153f51a83069f3471356553a27a2b)

Change-Id: Ib2e5d4cc660e0a278b9dbd10ac2db656239e1302
This commit is contained in:
Mark Vitale 2018-07-06 01:09:53 -04:00 committed by Benjamin Kaduk
parent b8142be4b4
commit 35240e3331
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/volser/volint.xg
View File

@ -65,6 +65,7 @@ statindex 16
%#define VOLDUMPV2_OMITDIRS 1 %#define VOLDUMPV2_OMITDIRS 1
const SIZE = 1024; const SIZE = 1024;
const NMAXNSERVERS = 13;
struct volser_status { struct volser_status {
afs_uint32 volID; /* Volume id--unique over all systems */ afs_uint32 volID; /* Volume id--unique over all systems */
@ -246,7 +247,7 @@ struct volintSize {
afs_uint64 dump_size; afs_uint64 dump_size;
}; };
typedef replica manyDests<>; typedef replica manyDests<NMAXNSERVERS>;
typedef afs_int32 manyResults<>; typedef afs_int32 manyResults<>;
typedef transDebugInfo transDebugEntries<>; typedef transDebugInfo transDebugEntries<>;
typedef volintInfo volEntries<>; typedef volintInfo volEntries<>;