Mailing-List: contact issues-help@spark.apache.org; run by ezmlm
Precedence: bulk
Date: Thu, 1 Jun 2017 21:47:05 +0000 (UTC)
From: "Marcelo Vanzin (JIRA)" <jira@apache.org>
To: issues@spark.apache.org
Message-ID: <JIRA.13075797.1496141883000.345499.1496353625135@Atlassian.JIRA>
In-Reply-To: <JIRA.13075797.1496141883000@Atlassian.JIRA>
References: <JIRA.13075797.1496141883000@Atlassian.JIRA> <JIRA.13075797.1496141883875@jira-lw-us.apache.org>
Subject: [jira] [Resolved] (SPARK-20922) Unsafe deserialization in Spark
 LauncherConnection
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Thu, 01 Jun 2017 21:47:11 -0000


     [ https://issues.apache.org/jira/browse/SPARK-20922?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:all-tabpanel ]

Marcelo Vanzin resolved SPARK-20922.
------------------------------------
       Resolution: Fixed
         Assignee: Marcelo Vanzin
    Fix Version/s: 2.3.0
                   2.2.1
                   2.1.2
                   2.0.3

> Unsafe deserialization in Spark LauncherConnection
> --------------------------------------------------
>
>                 Key: SPARK-20922
>                 URL: https://issues.apache.org/jira/browse/SPARK-20922
>             Project: Spark
>          Issue Type: Bug
>          Components: Spark Submit
>    Affects Versions: 2.1.1
>            Reporter: Aditya Sharad
>            Assignee: Marcelo Vanzin
>              Labels: security
>             Fix For: 2.0.3, 2.1.2, 2.2.1, 2.3.0
>
>         Attachments: spark-deserialize-master.zip
>
>
> The {{run()}} method of the class {{org.apache.spark.launcher.LauncherCon=
nection}} performs unsafe deserialization of data received by its socket. T=
his makes Spark applications launched programmatically using the {{SparkLau=
ncher}} framework potentially vulnerable to remote code execution by an att=
acker with access to any user account on the local machine. Such an attacke=
r could send a malicious serialized Java object to multiple ports on the lo=
cal machine, and if this port matches the one (randomly) chosen by the Spar=
k launcher, the malicious object will be deserialized. By making use of gad=
get chains in code present on the Spark application classpath, the deserial=
ization process can lead to RCE or privilege escalation.
> This vulnerability is identified by the =E2=80=9CUnsafe deserialization=
=E2=80=9D rule on lgtm.com:
> https://lgtm.com/projects/g/apache/spark/snapshot/80fdc2c9d1693f5b3402a79=
ca4ec76f6e422ff13/files/launcher/src/main/java/org/apache/spark/launcher/La=
uncherConnection.java#V58=20
> Attached is a proof-of-concept exploit involving a simple {{SparkLauncher=
}}-based application and a known gadget chain in the Apache Commons Beanuti=
ls library referenced by Spark.
> See the readme file for demonstration instructions.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org