mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Kevin ZhaoandgVisor bot
51b87d918a
Replace `math/rand` with `gvisor.dev/gvisor/pkg/rand` (backed by `crypto/rand` or `getrandom(2)`) in 5 security-sensitive code paths that currently use the non-cryptographic `math/rand`: | File | Usage | Risk | |------|-------|------| | `mm/syscalls.go` | Stack ASLR | Stack address prediction aids ROP | | `systrap/stub_unsafe.go` | Stub code layout | Sentry code location prediction | | `systrap/usertrap/usertrap_amd64.go` | Trap table layout | Syscall dispatch hijacking | | `netlink/port/port.go` | Port allocation | Port collision/hijacking | | `inet/abstract_socket_namespace.go` | Socket autobind | Socket name prediction | `math/rand` is not cryptographically secure — its output is deterministic given the internal state, which can be recovered from observed outputs (e.g., by observing one's own stack address via `/proc/self/maps` and deducing future randomization outputs for other processes in the same sandbox). `gvisor.dev/gvisor/pkg/rand` already provides matching API (`Uint32`, `Uint64`, `Int63n`) backed by `getrandom(2)` / `crypto/rand.Reader`. **Related**: CVE-2024-10026 and CVE-2024-10603 fixed the same class of weakness (`math/rand` for network identifiers) in the TCP/IP stack. These 5 files were not addressed by those fixes. COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/12695 from KevinZhao:fix/weak-prng-security-sensitive d6428ea368fd34d95d395a06bf99879678db2ac7 PiperOrigin-RevId: 892755849
66 lines
1.5 KiB
Python
66 lines
1.5 KiB
Python
load("//pkg/sync/locking:locking.bzl", "declare_mutex")
|
|
load("//tools:defs.bzl", "go_library")
|
|
load("//tools/go_generics:defs.bzl", "go_template_instance")
|
|
|
|
package(
|
|
default_applicable_licenses = ["//:license"],
|
|
default_visibility = ["//:sandbox"],
|
|
licenses = ["notice"],
|
|
)
|
|
|
|
go_template_instance(
|
|
name = "namespace_refs",
|
|
out = "namespace_refs.go",
|
|
package = "inet",
|
|
prefix = "namespace",
|
|
template = "//pkg/refs:refs_template",
|
|
types = {
|
|
"T": "Namespace",
|
|
},
|
|
)
|
|
|
|
declare_mutex(
|
|
name = "abstract_socket_namespace_mutex",
|
|
out = "abstract_socket_namespace_mutex.go",
|
|
package = "inet",
|
|
prefix = "abstractSocketNamespace",
|
|
)
|
|
|
|
declare_mutex(
|
|
name = "nlmcast_table_mutex",
|
|
out = "nlmcast_table_mutex.go",
|
|
package = "inet",
|
|
prefix = "nlmcastTable",
|
|
)
|
|
|
|
go_library(
|
|
name = "inet",
|
|
srcs = [
|
|
"abstract_socket_namespace.go",
|
|
"abstract_socket_namespace_mutex.go",
|
|
"context.go",
|
|
"inet.go",
|
|
"namespace.go",
|
|
"namespace_refs.go",
|
|
"nlmcast.go",
|
|
"nlmcast_table_mutex.go",
|
|
"test_stack.go",
|
|
],
|
|
deps = [
|
|
"//pkg/abi/linux",
|
|
"//pkg/atomicbitops",
|
|
"//pkg/context",
|
|
"//pkg/rand",
|
|
"//pkg/refs",
|
|
"//pkg/sentry/fsimpl/nsfs",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/socket/netlink/nlmsg",
|
|
"//pkg/sentry/socket/unix/transport",
|
|
"//pkg/sync",
|
|
"//pkg/sync/locking",
|
|
"//pkg/syserr",
|
|
"//pkg/tcpip",
|
|
"//pkg/tcpip/stack",
|
|
],
|
|
)
|