CVE-2022-46770: Infinite loop in console output on xen
Background
MirageOS is a library operating system using cooperative multitasking, which can be executed as a guest of the Xen hypervisor. Output on the console is performed via the Xen console protocol. Problem Description
Since MirageOS moved from PV mode to PVH, and thus replacing Mini-OS with solo5, there was an issue in the solo5 code which failed to properly account the already written bytes on the console. This only occurs if the output to be performed does not fit in a single output buffer (2048 bytes on Xen).
The code in question set the number of bytes written to the last written count (written = outputsome(buf)), instead of increasing the written count (written += outputsome(buf)).
Impact
Console output may lead to an infinite loop, endlessly printing data onto the console.
A prominent unikernel is the Qubes MirageOS firewall, which prints some input packets onto the console. This can lead to a remote denial of service vulnerability, since any client could send a malformed and sufficiently big network packet.
Solution
The solution is to fix the console output code in solo5, as done in https://github.com/Solo5/solo5/pull/538/commits/099be86f0a17a619fcadbb970bb9e511d28d3cd8
Timeline
- 2022-12-04: initial report by Krzysztof Burghardt https://github.com/mirage/qubes-mirage-firewall/issues/166 - 2022-12-04: investigation by Hannes Mehnert and Pierre Alain - 2022-12-05: initial fix by Pierre Alain https://github.com/Solo5/solo5/pull/538 - 2022-12-05: review of fix by Thomas Leonard - 2022-12-07: release of fixed packages and security advisory
Other sources
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opam/solo5to a version that resolves this vulnerability.Fixed in 0.7.5 - Upgrade
Upgrade
Solo5to a version that resolves this vulnerability.Patch 099be86f0a17a619fcadbb970bb9e511d28d3cd8
Event History
Frequently Asked Questions
What is CVE-2022-46770?
CVE-2022-46770 is a vulnerability in qubes-mirage-firewall 0.8.x through 0.8.3 that allows guest OS users to cause a denial of service via a crafted multicast UDP packet.
How severe is CVE-2022-46770?
CVE-2022-46770 has a severity value of 7.5, categorized as high.
What software versions are affected by CVE-2022-46770?
CVE-2022-46770 affects Mirage firewall for QubesOS versions 0.8.0 through 0.8.3.
How can the denial of service in CVE-2022-46770 be triggered?
The denial of service in CVE-2022-46770 can be triggered by guest OS users sending a crafted multicast UDP packet within the IP address range of 224.0.0.0 through 239.255.255.255.
Are there any references for CVE-2022-46770?
References related to CVE-2022-46770 can be found at http://packetstormsecurity.com/files/171610/Qubes-Mirage-Firewall-0.8.3-Denial-Of-Service.html and https://github.com/mirage/qubes-mirage-firewall/issues/166.