search

firecracker-microvm / firecracker

Secure and fast microVMs for serverless computing.
http://firecracker-microvm.io
Apache License 2.0
26.36k stars 1.83k forks source link

Firecracker serial console emulation may allocate an unbounded amount of memory #2177

Closed sandreim closed 4 years ago

sandreim commented 4 years ago

We have identified an issue in the Firecracker serial console emulation of all Firecracker versions up to v0.21.2 and Firecracker v0.22.0

Issue Description

The Firecracker implementation of the serial console emulation allows buffering of an unlimited number of bytes when data is written to the Firecracker process standard input at a high rate.

Impact

Firecracker customers that forward the standard input of the Firecracker process to untrusted users can become subject to DoS attacks. If memory limits are not imposed on the Firecracker process, this might impair other microVMs on the same host from allocating memory, potentially becoming an availability issue.

Serial output generated by the guest can’t trigger the issue.

Affected Systems

Firecracker versions v0.22.0 and v0.21.2, while all older releases might be impacted.

Mitigation

Impact can be mitigated by applying memory limits to the Firecracker process or by applying a rate limit when writing to the Firecracker process standard input.

Customers may apply: Patched binaries mitigating this issue have been released as Firecracker v0.21.3[1] and Firecracker v0.22.1[2]. If you are using Firecracker versions up to v0.21.2 or Firecracker v0.22.0, we recommend you apply the provided fix.

[1] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.21.3 [2] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.22.1

alindima commented 4 years ago

Issue was fixed in v0.22.1, v0.21.3 and v0.23.0. Closing this issue after adding the fix in mainline.