Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] windows: Enable default security parameters on file creation to avoid named pipe exploit #44556

Closed
wants to merge 1 commit into from
Closed

[WIP] windows: Enable default security parameters on file creation to avoid named pipe exploit #44556

wants to merge 1 commit into from

Commits on Sep 14, 2017

  1. windows: Enable default security parameters on file creation to avoid… 

    … named pipe exploit

Fixes rust-lang#42036

As noted in [this paper][1], the threat model for the exploit is a priveleged Rust process which accepts a file path from a malicious program. With this exploit, the malicious program can pass a named pipe to the priveleged process and gain its elevated priveleges.

The fix is to change the default OpenOptions to contain the proper security flags. [The .NET FileStream][2] has this same behavior by default. We're using the `SecurityIdentification` security level which is more permissive, but still blocks the exploit.

This is technically a breaking change. If someone were using a named pipe to impersonate a program *on purpose*, they would have to add `.security_qos_flags(0)` to their `OpenOptions` to keep working.

[1]: http://www.blakewatts.com/namedpipepaper.html
[2]: http://referencesource.microsoft.com/#mscorlib/system/io/filestream.cs,837
    @mattico
    mattico committed Sep 14, 2017
    Configuration menu
    Copy the full SHA
    d55c2d7 View commit details
    Browse the repository at this point in the history