Implement the mitigation for CVE-2020-35517 by applying the following changes:
- In InodeData::open_file(), return EBADF if the file we're opening is not a regular file nor a directory. - In PassthroughFs::create(), always pass libc::O_EXCL to libc::openat(), to ensure we're not being used to bypass the file mode restrictions at InodeData::open_file(). If the syscall fails with EEXIST, and libc::O_EXCL wasn't among the flags passed by the client, open the existing file using InodeData::open_file(). This is based on the work done by Stefan Hajnoczi and others for QEMU/virtiofsd: https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg01582.html This is an extract from the cover page of his patch series: --- A well-behaved FUSE client does not attempt to open special files with FUSE_OPEN because they are handled on the client side (e.g. device nodes are handled by client-side device drivers). The check to prevent virtiofsd from opening special files is missing in a few cases, most notably FUSE_OPEN. A malicious client can cause virtiofsd to open a device node, potentially allowing the guest to escape. This can be exploited by a modified guest device driver. It is not exploitable from guest userspace since the guest kernel will handle special files inside the guest instead of sending FUSE requests. This patch series fixes this issue by introducing the lo_inode_open() function to check the file type before opening it. This is a short-term solution because it does not prevent a compromised virtiofsd process from opening device nodes on the host. This issue was diagnosed on public IRC and is therefore already known and not embargoed. --- Fixes: CVE-2020-35517 Fixes: #9 Reported-by: Alex Xu <[email protected]> Signed-off-by: Sergio Lopez <[email protected]> --- https://gitlab.com/virtio-fs/virtiofsd-rs/-/merge_requests/38 _______________________________________________ Virtio-fs mailing list [email protected] https://listman.redhat.com/mailman/listinfo/virtio-fs
