Various hardening and robustness improvements for pmxcfs

Details

Several issues which could potentially be triggered by unprivileged users were fixed in pmxcfs:

On clusters with a high amount of virtual guests, certain IPCC requests to the running pmxcfs instance could cause a crash/denial of service.

A misbehaving IPCC client could cause a crash/denial of service by not reading IPCC responses.

An empty sparse file that is stored on pmxcfs could cause a crash/denial of service when being read.

pmxcfs was vulnerable to path confusions with paths containing repeated / characters, which could cause a crash/denial of service or allow reading of root-only files by users in the www-data group.

Requests were parsed from memory still owned by the IPCC client, which allowed users in the www-data group to crash pmxcfs by modifying the contents of an in-flight request.

Length fields were not read and checked in all cases before processing the corresponding value fields.

API token values were not compared in constant time, potentially allowing timing attacks.

Some checks and error handling paths when parsing or handling malformed messages were incomplete and have been improved.

One overflow issue was found and privately reported by Geoffrey McClinsey <[email protected]>. One invalid length check was reported in https://bugzilla.proxmox.com/show_bug.cgi?id=8100 (opens in a new tab) . The rest of the issues were found and fixed internally.

Fixed in

• pve-cluster >= 9.1.7