process: refuse GetMemoryDump of the server's own process and pid 1 - #641
Open
sfc-gh-ikryvanos wants to merge 2 commits into
Open
process: refuse GetMemoryDump of the server's own process and pid 1#641sfc-gh-ikryvanos wants to merge 2 commits into
sfc-gh-ikryvanos wants to merge 2 commits into
Conversation
Producing a memory dump of the sansshell server's own process would expose its in-memory secrets (for example its private TLS key), and pid 1 is never a legitimate dump target. Guard the target pid via an overridable predicate so deployments can enforce a narrower allowlist.
![arcticowl-ai-review-labs[bot]](https://avatars.githubusercontent.com/u/58992620?s=60&v=4){kind=small}
Comment on lines
+129
to
+137
| var memoryDumpTargetAllowed = func(pid int) error { | ||
| if pid == os.Getpid() { | ||
| return status.Error(codes.PermissionDenied, "refusing to dump the sansshell server's own process") | ||
| } | ||
| if pid == 1 { | ||
| return status.Error(codes.PermissionDenied, "refusing to dump pid 1") | ||
| } | ||
| return nil | ||
| } |
There was a problem hiding this comment.
🟠 MEDIUM · GetMemoryDump target guard omits child/related PIDs and defaults to allowing any non-self, non-PID-1 process · CWE-284
Attaching to the sansshell server's own process can expose its in-memory secrets, and pid 1 is never a legitimate target. These RPCs also briefly stop the target, so restricting them limits abuse. Guard the target pid via an overridable predicate so deployments can enforce a narrower allowlist.
Comment on lines
+129
to
+137
| var memoryDumpTargetAllowed = func(pid int) error { | ||
| if pid == os.Getpid() { | ||
| return status.Error(codes.PermissionDenied, "refusing to dump the sansshell server's own process") | ||
| } | ||
| if pid == 1 { | ||
| return status.Error(codes.PermissionDenied, "refusing to dump pid 1") | ||
| } | ||
| return nil | ||
| } |
There was a problem hiding this comment.
🟠 MEDIUM · GetMemoryDump can dump arbitrary PIDs; guard only excludes self and PID 1 (sensitive-data exposure) · CWE-200
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Producing a memory dump of the sansshell server's own process would expose its in-memory secrets (for example its private TLS key), and pid 1 is never a legitimate dump target. Guard the target pid via an overridable predicate so deployments can enforce a narrower allowlist.