AWS Firecracker through v0.19.0 has a Buffer Overflow vuln

http://ukadventureracing.co.uk/groups/training/members/?mlpage=2 Overview :
A logical error in bounds checking performed on vsock virtio descriptors can be used by a malicious guest to read from and write to a segment of the host-side Firecracker process’ heap address space, directly after the end of a guest memory region. For reads, the accessible segment’s size is 64 KiB. For writes, the accessible segment is limited by the host Linux kernel to a size defined in /proc/sys/net/core/rmem_max. We expect the value of rmem_max to be on the order of a few hundred KiB to a few MiB.
sorrily Affected Product(s) :
  • Firecracker v0.18.0 and v0.19.0
Vulnerability Details :
CVE ID : CVE-2019-18960
This will generally result in a segmentation fault, but remote code execution within the Firecracker host-side process context cannot be ruled out.

Only Firecracker v0.18.0 and v0.19.0 are affected. Only Firecracker microVMs with configured vsock devices are affected, and only if one or more vsock devices are in active use by both host and guest.

Remediation / Fixes :

Patched binaries for the affected versions have been released as Firecracker v0.18.1 [1] and Firecracker v0.19.1 [2]. If you are using Firecracker v0.18.0 or v0.19.0 , we recommend you apply the provided fix. If you are using Firecracker v0.17.0 or below, you do not need to take any action.

In a remote code execution scenario, users running Firecracker in line with the recommended Production Host Setup will see the impact limited as follows: a malicious microVM guest that would manage to compromise the Firecracker VMM process would be restricted to running on the host as an unprivileged user, in a chroot and mount namespace isolated from the host’s filesystem, in a separate pid namespace, in a separate network namespace, with system calls limited to Firecracker’s seccomp whitelist, on a single NUMA node, and on a cgroups-limited number of CPU cores.

[1] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.18.1

[2] https://github.com/firecracker-microvm/firecracker/releases/tag/v0.19.1

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2024-26817 : LINUX KERNEL UP TO 6.8.5 AMDKFD KZALLOC INTEGER OVERFLOW

CVE-2024-26817 : LINUX KERNEL UP TO 6.8.5 AMDKFD KZALLOC INTEGER OVERFLOW

Description In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer

CVE-2024-3400 : PALO ALTO NETWORKS PAN-OS GLOBALPROTECT COMMAND INJECTION

CVE-2024-3400 : PALO ALTO NETWORKS PAN-OS GLOBALPROTECT COMMAND INJECTION

Description A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and

CVE-2024-21508 : MYSQL2 UP TO 3.9.3 READCODEFOR BIGNUMBERSTRINGS CODE INJECTION

CVE-2024-21508 : MYSQL2 UP TO 3.9.3 READCODEFOR BIGNUMBERSTRINGS CODE INJECTION

Description Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due