Yan Xu created MESOS-6866:
-----------------------------
Summary: Mesos agent not checking IDs before using them as part of
the paths
Key: MESOS-6866
URL: https://issues.apache.org/jira/browse/MESOS-6866
Project: Mesos
Issue Type: Bug
Components: security
Reporter: Yan Xu
Various IDs are used in Mesos, some assigned by the master (AgentID,
FrameworkID, etc) and some created by the frameworks (TaskID, ExecutorID etc).
The master does sufficient validation on the IDs supplied by the frameworks and
the agent currently just trusts that the IDs are valid because they have been
validated.
The problem is that currently any entity can spoof as the master to inject
certain actions on the agent which can be executed as "root" and inflict harm
on the system. The "right" long term fix is of course to prevent this from
happening but as a short-term defensive measure we can insert some hard CHECKs
on the validity of the IDs in the agent code paths.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
