9 ms·
Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
- charcircuit 18d agoAnother example for why system() is so dangerous to use. I also don't understand why it needs to show the dialog in dom0. If you have the option to handle attacker controlled input on the unprivileged side, you should do that instead of putting a lot of logic on the privileged side.
- HackerThemAll 18d ago> why it needs to show the dialog in dom0 I think it's the "secure screen" that cannot be manipulated by the malware in a VM. I'd expect a password entry dialog to also be handled like that.
- charcircuit 17d agoIt's for an the "File copy/move error" error dialog.
- danielheath 17d agoIf you're going to put the graphics and NIC into separate VMs, surely the secure screen can be another of those semi-privileged VMs rather than part of dom0
- delamon 18d agoThe code is sloppy. They check existance of kdialog binary using full path; next step they rely on PATH search by shell. If would've been much safer to just do execve directly.
- polotics 18d agoI'm still very impressed by qubes, and glad I'm not such a target that I feel I need the level of opsec it affords (on all my laptops). Maybe someday AI-assisted killchains will be so widespread that Qubes is the minimal level for the (few?) still-local users of compute. I would not have copied anything from dom0 to any another qube, the impact is low.
- negura 17d ago> I would not have copied anything from dom0 to any another qube, the impact is low. You'd typically copy logs, to open issue tickets etc.
- zby 18d agoI am still impressed by QubesOS track and I use it for my dedicated 'financials' laptop. IMHO the thing that is holding back QubesOS is the lack of hardware acceleration for graphics - maybe now when dual monitor setups are getting popular this could be a workaround for the security considerations?
- jwrallie 17d agoI dropped QubesOS once exactly for that reason in the past but now I’m running it again on a separate computer. Even with all its drawbacks, there is something really nice about being able to run different applications over Tor, VPN or plain internet simultaneously, the ability to isolate non-safe binaries and being able to backup your VMs easily. I wish a similar distro would be made based on KVM so that the standard kernel could be used. It would be great for compatibility.
- fsflover 17d ago> I wish a similar distro would be made based on KVM There is an Issue for that: https://github.com/QubesOS/qubes-issues/issues/7051 https://github.com/QubesOS/qubes-issues/issues/7051
- tom_alexander 17d ago> being able to run different applications over Tor, VPN or plain internet simultaneously, the ability to isolate non-safe binaries and being able to backup your VMs easily. These are all possible using light containers. For example, on FreeBSD I will spin up a jail which runs wireguard, and then I'll bridge that to another a jail. That 2nd jail is running entirely off wireguard without any other way to access the network. Since it is a jail, it is isolated. And backing up is as simple as a zfs snapshot and zfs send. I assume the same is possible on Linux.
- majorchord 17d agoI would argue non-safe binaries are not safe in a container either. And even with full VMs, there have been an embarrassing number of escape exploits over the years.
- msm_ 17d agoWow, this is serious. Makes you think, that even though QubesOS attack surface is so tiny (well-designed to be secure) there are still vulnerabilities to be found. Worth noting that (as I understand) this vulnerability occurs only when doing copy-to-VM from Dom0: >Note that the VM variant of `qvm-copy-to-vm` is not affected, as its version of the error reporting function does not use `system()`: Since you should not use Dom0 for regular work, and definitely not for interacting with likely-to-be-infected VMs, the scope of this attack is smaller than it sounds. On the flip side, when it works, it elevates privileges straight to Dom0.
- Topfi 17d agoYou are right, copying to dom0 is not best practices and warned against since anno dazumal, but given the user groups I remember not always being technically minded (journalists, dissidents, etc.) and ensuring qubeses isolation holds even when users do things they are discouraged from has always been part of the philosophy. Don’t trust users, don’t trust userland, don’t trust software and all that yazz.
- nickzana 17d agoI believe this is a vulnerability that occurs when copying data from dom0, which is a more common task. Generally the Qubes model recommends copying data from more trusted VMs to less trusted VMs, and dom0 still runs some system-wide processes in many default configurations. For example when you take a screenshot with xfce4-screenshooter, the file is saved to dom0, and you have to use qvm-copy-to-vm to move it to a (less trusted) qube to do something with it. That's the most frequent use case, at least for me.
- deathanatos 17d ago> well-designed to be secure While I suppose this doesn't say the design isn't secure, system() is one of those calls that has no place in modern code. It is insecure by its design. > Any user input that is employed as part of `command` should be carefully sanitized, to ensure that unexpected shell commands or command options are not executed. Such risks are especially grave when using system() from a privileged program. (—man 3 system)
- TacticalCoder 17d agoI do really like the following in the bulletin: > Important: At this point, you still don’t know whether the key you just imported is the genuine QMSK or a forgery. In order for this entire procedure to provide meaningful security benefits, you must authenticate the QMSK out-of-band. Do not skip this step! The standard method is to obtain the QMSK fingerprint from multiple independent sources in several different ways and check to see whether they match the key you just imported. For more information, see How to import and authenticate the Qubes Master Signing Key. It looks like Qubes is ran by people who take security seriously, which is refreshing.
- leonidasrup 17d agoHow well is QMSK protected from a serious attacker?
- inigyou 17d agoI own a Qubes T-shirt which I bought in person at FOSDEM. The design on the T-shirt consists of many copies of the QMSK in hexadecimal. All of their merch is like this.
- sdcfgy 17d agoReminds me of Theo DeRaadt again: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582
- throwa356262 17d agoTheo is a very insightful guy, but also very opinionated. I think the truth is somewhere in between. Especially as more and more virtualization functions move into hardware, not using them as a second security barrier seems foolish.
- 12995816 17d ago[flagged]
- Topfi 17d agoIt has? News to me. Go on any major thread on this page, you’ll witness similarly strong pushback visa-vi buying into corporate backed hype, akin to the overconfidence in virt security he pointed at back then.
- XMPPwocky 17d agoLooks like this has nothing to do with the hypervisor, it's not a traditional VM escape
- fallat 17d agoBrutal I hope when people read this though they understand this is a communication style; they're clearly trying to strongly discourage people from thinking they are suddenly protected. Effective? Maybe at one time, where "macho dev energy" was a thing. Today, not so much. You can tell they mean well because the intro sentence is actually pretty cheeky!
- 12995816 17d agoPeculiar stuff. I'm always skeptical of these security Linux distributions, but this bug is so bad that it seems like an infiltration of Qubes at best or Qubes being a honeypot at worst.
- Topfi 17d agoThat is sphincter tightening to read. Have to point out how amazingly well their bulletins handle communication. Clearly describes the issues, how users are to act, etc. in, what I feel, is an easy to grasp language, even if one’s not in the weeds that much. In fairness though, I do still have some past memories concerning Qubes architecture from way back, so maybe my assessment is wrong and this is still not that straight forward to grasp for most.
- _pdp_ 17d agoMost security bugs are due to improper string validation and use.
- edelbitter 17d ago(Obviously a take that does not get very far in lower level programming, but from the comfort of some abstractions away:) I like to think of buffer overruns, command injections and path traversal as all the same category of bug: type confusion. Nothing special. An no excuse to risk any of them, if the logic implementing them is expected to be called just O(1) times anyway.
- Allwinkt 17d agoThe worst part is that in 2020 they explicitly documented that the remote filename is attacker controlled,but still allowed it to reach system() That is C security 101: never pass untrusted input through a shell. This should have been caught in review!
- Allwinkt 17d agoThe worst part is that in 2020 they explicitly documented that the remote filename is attacker controlled,but still allowed it to reach system() This is C security 101: never pass untrusted input through a shell. This should have been caught in the review!
- palata 17d agoIsn't it the case for all bugs? If they appear in the production software, it means that they passed the review. And obviously bugs shouldn't pass the review, but that's easier said than done.
- vlovich123 17d agoThis should be made structurally impossible through type safety rather relying on code review.
- ka3ki 17d agoit's kinda doomed at this point
- ka3ki 17d ago[flagged]
- Cider9986 17d agoGrapheneOS is highly usable and secure.
- kimberlysatterf 17d ago[dead]
- iberator 17d agoThis os is supposed to be run on bare metal AFIK for same reason
- grommz 17d agoThe founder Joanna Rutkowska left QubesOS in 2018. All the code involved in this bug was committed by her successor Marek Marczykowski-Górecki. Joanna seems to be a genuine good guy, she once wrote a paper titled "Intel x86 considered harmful". That's why Huawei and the Chinese government aren't even trying any more to make western CPU architectures secure, it's a hopeless cause.
- jervant 17d ago[flagged]
- tdb7893 17d agoI feel like "guy" is weird in that I often hear people say "you guys" (and similar phrases) to groups of women but "guy" on its own is referring to a man at least 99% of the times I hear it. I'm curious if other people actually use it completely non-gendered (it's definitely gendered in the places I've lived in the US).
- throwawayffffas 17d agoIt's always gendered in the singular, very rarely people may use the singular in a non gendered way and usually this conversation that we are having follows.
- woodruffw 17d agoIs there some evidence that x86 is uniquely prone to exploitable memory corruption? I haven't seen it, if so. > That's why Huawei and the Chinese government aren't even trying any more to make western CPU architectures secure, it's a hopeless cause. I suspect there are much more boring reasons for this, ranging from licensing to geopolitics (i.e., it being useful/valuable to have a domestic base of engineers who can design an ISA).
- upboundspiral 17d agoThe paper X86 considered harmful was about how the BIOS / Intel management Engine (now also AMD PSP), are completely opaque. If the lowest layer is hidden, proprietary, there are infinite vectors for state actors to include their desired backdoors.
- hneqy2wqls 17d ago[dead]
- anArbitraryOne 17d agoMy username checks out
- bawolff 17d agoits kind of fascinating that all this paranoia falls to a shell escaping issue with system().
- user_7832 17d agoMini tangent: Could someone explain to me why Qubes is used for security, when (from what I understand) Jails on BSD is significantly more robust/safe/has a much smaller exposed area? Is it just "everyone's using linux already; here's a safer linux"?
- zvmaz 17d agoQubes can be viewed as a Xen distribution, rather than a Linux distribution [1]. You may find the Qubes FAQ a good starting point (I'm reading it now because of your question, so thanks). [1] https://doc.qubes-os.org/en/latest/introduction/faq.html#is-qubes-just-another-linux-distribution https://doc.qubes-os.org/en/latest/introduction/faq.html#is-...
- amarshall 17d agoQubes uses VMs, Jails use a shared kernel. So I wouldn’t say Jails are safer nor that they have a smaller exposed area with regard to host isolation than VMs.
- Naru41 17d agoIf it's `untrusted_filename`, it should at least accept the length of the string as an argument.
- crest 17d agoReally an attacker controlled system() call?!?
- dhruvrrp 17d agoTangentially, their steps listed to verify PGP signature is the prime example of why PGP has such dismal adoption.
- ferrule 17d agoError reporting backchannels are often overlooked attack vectors. Pretty wild to see Qubes OS, of all systems, fall to such a subtle vector.
- myshapeprotocol 17d ago[dead]
- devhunt-org 17d agoIt’s a good reminder that security boundaries are only as strong as the small utilities around them. The vulnerability is especially interesting because the dangerous behavior isn't in the main virtualization layer, but in something as mundane as error reporting.
- throwawayffffas 17d agoVery small attack surface, I have been using qubes for years, never had to copy a file from dom0 to a vm.
- forest_brothers 16d ago[flagged]
- kurdman_007 16d ago[dead]