[device/mellanox] Mitigation for security vulnerability #11877

maipbui · 2022-08-29T17:12:33Z

Signed-off-by: maipbui maibui@microsoft.com

Dependency: PR (#12065) needs to merge first.

Why I did it

subprocess.Popen() and subprocess.check_output() is used with shell=True, which is very dangerous for shell injection.

How I did it

Disable shell=True, enable shell=False

How to verify it

Tested on DUT, compare and verify the output between the original behavior and the new changes' behavior.
testresults.zip

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft

LGTM. Please wait more reviewers to verify and approve.

Yarden-Z · 2022-09-13T13:54:22Z

I see that this change was done only for 2700, we do not want to backport this?

maipbui · 2022-09-13T19:56:53Z

I see that this change was done only for 2700, we do not want to backport this?

@Yarden-Z, Qi added backport. can you check you can review and approve?

Yarden-Z · 2022-09-14T06:27:19Z

I see that this change was done only for 2700, we do not want to backport this?

@Yarden-Z, Qi added backport. can you check you can review and approve?

Seems as though it is referenced to 2700 in other platforms.
Verified and approved

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-09-16T17:04:06Z

This pull request fixes 1 alert when merging bd9cf87 into a1b50ca - view on LGTM.com

fixed alerts:

1 for Unused import

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-09-16T19:14:33Z

This pull request fixes 1 alert when merging 20e2cd7 into a1b50ca - view on LGTM.com

fixed alerts:

1 for Unused import

qiluo-msft · 2022-09-16T22:45:59Z

platform/mellanox/mlnx-platform-api/sonic_platform/component.py

+                    fs_path = p3.communicate()[0].rstrip('\n')
+                    p1.wait()
+                    p2.wait()
+                    if p1.returncode != 0 and p2.returncode != 0 and p3.returncode != 0:


and

or #Closed

qiluo-msft · 2022-09-16T22:46:53Z

platform/mellanox/mlnx-platform-api/sonic_platform/component.py

+        cmd1 = ['fdisk', '-l']
+        cmd2 = ['grep', 'ONIE boot']
+        cmd3 = ['awk', '{print $1}']
+        with subprocess.Popen(cmd1, universal_newlines=True, stdout=subprocess.PIPE) as p1:


with subprocess.Popen(cmd1, universal_newlines=True, stdout=subprocess.PIPE) as p1:

Possible to move to common library, maybe the 2 cmd function could be extended to multiple cmds. #Closed

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-09-18T02:36:24Z

This pull request introduces 1 alert and fixes 1 when merging a16ed29 into 1effff9 - view on LGTM.com

new alerts:

1 for Variable defined multiple times

fixed alerts:

1 for Unused import

maipbui · 2022-09-20T01:12:14Z

@Yarden-Z I made some changes, could you help review?

maipbui · 2022-09-20T01:12:48Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-09-20T01:13:00Z

Azure Pipelines successfully started running 1 pipeline(s).

Yarden-Z · 2022-10-03T11:17:24Z

@Yarden-Z I made some changes, could you help review?

Went over the new commit, did not find anything new to comment on.

lgtm-com · 2022-10-03T15:24:53Z

This pull request introduces 1 alert and fixes 1 when merging ba3c5de into 2f46689 - view on LGTM.com

new alerts:

1 for Variable defined multiple times

fixed alerts:

1 for Unused import

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-10-05T20:47:15Z

This pull request introduces 1 alert and fixes 1 when merging 1e62cff into 1f0699f - view on LGTM.com

new alerts:

1 for Variable defined multiple times

fixed alerts:

1 for Unused import

Signed-off-by: maipbui <maibui@microsoft.com>

lgtm-com · 2022-10-05T23:16:43Z

This pull request introduces 1 alert and fixes 1 when merging c35ec09 into 1f0699f - view on LGTM.com

new alerts:

1 for Variable defined multiple times

fixed alerts:

1 for Unused import

stephenxs · 2022-10-21T02:21:32Z

platform/mellanox/mlnx-platform-api/sonic_platform/component.py

-        cmd = "mount -n -r -t ext4 {} {}".format(fs_path, fs_mountpoint)
-        subprocess.check_call(cmd, shell=True, universal_newlines=True)
+        cmd = ["mount", "-n", "-r", "-t", "ext4", fs_path, fs_mountpoint]
+        subprocess.check_call(cmd, universal_newlines=True)


It is not able to mount fs without shell=True.
Looks like it doesn't have the privilege to access /dev/sda2/

could you share the error log?

My bad. it doesn't relevant to the PR. it's because there is a \n at the end of /dev/sda2.
We will fix it on the platform API side.
Sorry for the inconvenient.

Sorry. I realized the missing \n was still introduced by this PR. PR #12465 to fix it. can you please review it?
thanks.

Thanks for the fix!

This fixes the following error ``` admin@sonic:~$ sudo fwutil show status mount: /mnt/onie-fs: special device /dev/sda2 does not exist. Error: Command '['mount', '-n', '-r', '-t', 'ext4', '/dev/sda2\n', '/mnt/onie-fs']' returned non-zero exit status 32.. Aborting... Aborted! admin@sonic:~$ sudo vi /usr/local/lib/python3.9/dist-packages/sonic_platform/ ``` Seems like #11877 the rstrip('\n') was removed. Probably by mistake. Signed-off-by: Stephen Sun <stephens@nvidia.com>

Related work items: sonic-net#2151, sonic-net#2194, sonic-net#2224, sonic-net#2237, sonic-net#2264, sonic-net#2281, sonic-net#2286, sonic-net#2297, sonic-net#2299, sonic-net#2305, sonic-net#2325, sonic-net#2335, sonic-net#2338, sonic-net#2341, sonic-net#2343, sonic-net#2347, sonic-net#2350, sonic-net#2355, sonic-net#2356, sonic-net#2358, sonic-net#2360, sonic-net#2363, sonic-net#2367, sonic-net#2368, sonic-net#2370, sonic-net#2374, sonic-net#2392, sonic-net#2398, sonic-net#2408, sonic-net#2414, sonic-net#2415, sonic-net#2419, sonic-net#2421, sonic-net#2422, sonic-net#2423, sonic-net#2426, sonic-net#2427, sonic-net#2430, sonic-net#2431, sonic-net#2433, sonic-net#2434, sonic-net#2436, sonic-net#2437, sonic-net#2441, sonic-net#2444, sonic-net#2445, sonic-net#2446, sonic-net#2456, sonic-net#2458, sonic-net#2460, sonic-net#2461, sonic-net#2463, sonic-net#2472, sonic-net#2475, sonic-net#11877, sonic-net#12024, sonic-net#12065, sonic-net#12097, sonic-net#12130, sonic-net#12209, sonic-net#12217, sonic-net#12244, sonic-net#12251, sonic-net#12255, sonic-net#12276, sonic-net#12284

Mitigate security vulnerabilities in subprocess

0b2d9ff

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui requested a review from qiluo-msft August 29, 2022 17:15

Convert command string to command array

3953ca2

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft requested review from stephenxs, dprital, dgsudharsan and liat-grozovik August 30, 2022 22:09

qiluo-msft approved these changes Aug 30, 2022

View reviewed changes

maipbui marked this pull request as ready for review September 1, 2022 04:35

qiluo-msft added Request for 201911 Branch Request for 202006 Branch Request for 202012 Branch Request for 202106 Branch Request for 202111 Branch For PRs being requested for 202111 branch Request for 202205 Branch labels Sep 13, 2022

Replace shell=True and os.system in mlnx-platform-api

d273d60

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui requested a review from lguohan as a code owner September 15, 2022 18:48

maipbui added 4 commits September 15, 2022 19:01

Replace shell=True

34ab55c

Signed-off-by: maipbui <maibui@microsoft.com>

Resolve conflict

7e3d01e

Signed-off-by: maipbui <maibui@microsoft.com>

Add pytest import

98ef8c2

Signed-off-by: maipbui <maibui@microsoft.com>

Merge branch 'master' into mellanox_security

bd9cf87

Fix command

20e2cd7

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft reviewed Sep 16, 2022

View reviewed changes

Use common lib function

a16ed29

Signed-off-by: maipbui <maibui@microsoft.com>

qiluo-msft approved these changes Sep 19, 2022

View reviewed changes

Merge branch 'master' into mellanox_security

ba3c5de

Fix build

1e62cff

Signed-off-by: maipbui <maibui@microsoft.com>

Remove run

c35ec09

Signed-off-by: maipbui <maibui@microsoft.com>

maipbui merged commit 648ca07 into sonic-net:master Oct 6, 2022

maipbui deleted the mellanox_security branch October 6, 2022 21:51

qiluo-msft removed Request for 201911 Branch Request for 202006 Branch Request for 202012 Branch Request for 202106 Branch Request for 202111 Branch For PRs being requested for 202111 branch Request for 202205 Branch labels Oct 12, 2022

stephenxs reviewed Oct 21, 2022

View reviewed changes

stephenxs mentioned this pull request Oct 22, 2022

Remove \n from the end of fs_path in ONIEUpdater #12465

Merged

7 tasks

maipbui added the Static Code Analysis label Nov 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[device/mellanox] Mitigation for security vulnerability #11877

[device/mellanox] Mitigation for security vulnerability #11877

maipbui commented Aug 29, 2022 •

edited

Loading

qiluo-msft left a comment

Yarden-Z commented Sep 13, 2022

maipbui commented Sep 13, 2022

Yarden-Z commented Sep 14, 2022

lgtm-com bot commented Sep 16, 2022

lgtm-com bot commented Sep 16, 2022

qiluo-msft Sep 16, 2022 •

edited

Loading

qiluo-msft Sep 16, 2022 •

edited

Loading

lgtm-com bot commented Sep 18, 2022

maipbui commented Sep 20, 2022

maipbui commented Sep 20, 2022

azure-pipelines bot commented Sep 20, 2022

Yarden-Z commented Oct 3, 2022

lgtm-com bot commented Oct 3, 2022

lgtm-com bot commented Oct 5, 2022

lgtm-com bot commented Oct 5, 2022

stephenxs Oct 21, 2022 •

edited

Loading

maipbui Oct 21, 2022

stephenxs Oct 21, 2022

stephenxs Oct 23, 2022

maipbui Oct 24, 2022

[device/mellanox] Mitigation for security vulnerability #11877

[device/mellanox] Mitigation for security vulnerability #11877

Conversation

maipbui commented Aug 29, 2022 • edited Loading

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

qiluo-msft left a comment

Choose a reason for hiding this comment

Yarden-Z commented Sep 13, 2022

maipbui commented Sep 13, 2022

Yarden-Z commented Sep 14, 2022

lgtm-com bot commented Sep 16, 2022

lgtm-com bot commented Sep 16, 2022

qiluo-msft Sep 16, 2022 • edited Loading

Choose a reason for hiding this comment

qiluo-msft Sep 16, 2022 • edited Loading

Choose a reason for hiding this comment

lgtm-com bot commented Sep 18, 2022

maipbui commented Sep 20, 2022

maipbui commented Sep 20, 2022

azure-pipelines bot commented Sep 20, 2022

Yarden-Z commented Oct 3, 2022

lgtm-com bot commented Oct 3, 2022

lgtm-com bot commented Oct 5, 2022

lgtm-com bot commented Oct 5, 2022

stephenxs Oct 21, 2022 • edited Loading

Choose a reason for hiding this comment

maipbui Oct 21, 2022

Choose a reason for hiding this comment

stephenxs Oct 21, 2022

Choose a reason for hiding this comment

stephenxs Oct 23, 2022

Choose a reason for hiding this comment

maipbui Oct 24, 2022

Choose a reason for hiding this comment

maipbui commented Aug 29, 2022 •

edited

Loading

qiluo-msft Sep 16, 2022 •

edited

Loading

qiluo-msft Sep 16, 2022 •

edited

Loading

stephenxs Oct 21, 2022 •

edited

Loading