search

coreos / fedora-coreos-tracker

Issue tracker for Fedora CoreOS
https://fedoraproject.org/coreos/
264 stars 59 forks source link

Consider referencing GCP metadata service by IP in Ignition/Afterburn #891

Closed bgilbert closed 3 years ago

bgilbert commented 3 years ago

On GCP, both Ignition and Afterburn access the GCE metadata service via the hostname metadata.google.internal without any further authentication of the service, as instructed by official documentation. An attack that rebinds that hostname can inject arbitrary code (Ignition) or SSH keys (Afterburn). There have been multiple exploits that involve poisoning that hostname via forged DHCP replies and a vulnerable DHCP hook called google_set_hostname. We don't ship that script, but since DNS poisoning in this case leads to trivial instance takeover, we should perhaps consider mitigations.

metadata.google.internal resolves to 169.254.169.254. One option is to just hardcode that IP. It's not clear that Google has documented the address as stable, but it'd probably be hard to change it at this point. Other clouds use the same address.

In the case of Ignition, another potential option is to query the metadata service before a globally routable address has been configured. However, that would require structural changes to Ignition, since merged configs are fetched in the same Ignition stage as the main config. It also wouldn't help Afterburn.

xref https://github.com/coreos/fedora-coreos-tracker/issues/885

lucab commented 3 years ago

Looking a bit more into GCP related material, the explicit 169.254.169.254 address is already referenced in a few places:

Specifically, a comment in the Go library says this IP address is documented as being stable anyway.

jlebon commented 3 years ago

We discussed this in the meeting today:

12:51:03 < bgilbert> #agreed we will switch Ignition and Afterburn to contact the GCP metadata
                     service by IP instead of hostname, unless we receive significant information
                     to the contrary by next week
bgilbert commented 3 years ago

PRs in https://github.com/coreos/ignition/pull/1247 and https://github.com/coreos/afterburn/pull/595.

bgilbert commented 3 years ago

Both PRs have merged upstream. Closing this out.

dustymabe commented 2 years ago

Those changes landed in Ignition 2.12.0 and Afterburn 5.1.0. Those versions are in the current latest stable.

The fix for this went into stable stream release 35.20211029.3.0.