Guard against malformed /etc/group and /etc/passwd lines#313
Open
arpitjain099 wants to merge 1 commit into
Open
Guard against malformed /etc/group and /etc/passwd lines#313arpitjain099 wants to merge 1 commit into
arpitjain099 wants to merge 1 commit into
Conversation
The group and user assessors split each line on ':' and read data[2] without checking the length first, so a blank line, a comment line, or any entry with fewer than three fields in a scanned image's /etc/group or /etc/passwd panics dockle with an index out of range. The passwd assessor already skips blank/comment lines and length-checks before indexing. Apply the same guard to group.go and user.go, and add tests covering the malformed-line cases and the existing duplicate GID/UID detection. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi, I do supply-chain security work and was looking at how dockle parses files pulled out of a scanned image. I found a crash on malformed input in two of the assessors.
The group and user assessors read
/etc/groupand/etc/passwdlike this:There is no length check before
data[2], so any line with fewer than three colon-separated fields blows up withindex out of range [2]. That covers a blank line in the middle of the file, a comment line, or any truncated/malformed entry. Since the file contents come straight from the layers of whatever image is being scanned, and there is norecover()on the scan path, one odd line crashes the whole run.The passwd assessor next door already handles this correctly: it skips empty and
#lines and checks the field count before indexing. This change just brings the same guard to group.go and user.go, so short lines are skipped (with a debug log) instead of panicking.I added unit tests for both assessors that feed a body containing a valid row, a blank line, a comment line and a couple of short entries. Before the change
Assesspanics on those; after it, it returns cleanly. The tests also keep a case for the existing duplicate GID/UID detection so that behavior stays covered.go test ./pkg/assessor/...passes.