CVE-2020-27174: Firecracker serial console emulation may allocate an unbounded amount of memory

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
CVE-2020-27174: Firecracker serial console emulation may allocate an unbounded amount of memory

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: "Iordache, Alexandra" &lt;aghecen () amazon com&gt;

Date: Fri, 23 Oct 2020 10:42:14 +0000

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
We have identified an issue in the Firecracker serial console emulation of all Firecracker versions up to v0.21.2 and 
Firecracker v0.22.0

# Issue Description

The Firecracker implementation of the serial console emulation allows buffering of an unlimited number of bytes when 
data is written to the Firecracker process standard input at a high rate.

# Impact

Firecracker customers that forward the standard input of the Firecracker process to untrusted users can become subject 
to DoS attacks. If memory limits are not imposed on the Firecracker process, this might impair other microVMs on the 
same host from allocating memory, potentially becoming an availability issue.

Serial output generated by the guest can't trigger the issue.

# Affected Systems

Firecracker versions v0.22.0 and v0.21.2, while all older releases might be impacted.

# Mitigation

Impact can be mitigated by applying memory limits to the Firecracker process or by applying a rate limit when writing 
to the Firecracker process standard input.

Customers may apply:
Patched binaries mitigating this issue have been released as Firecracker v0.21.3[1] and Firecracker v0.22.1[2].
If you are using Firecracker versions up to v0.21.2 or Firecracker v0.22.0, we recommend you apply the provided fix.

[1] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.21.3
[2] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.22.1?

Best regards,
Alexandra on behalf of the Firecracker maintainers team?

Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 
700045, Romania. Registered in Romania. Registration number J22/2621/2005.

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2020-27174: Firecracker serial console emulation may allocate an unbounded amount of memory Iordache, Alexandra (Oct 23)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->