thrift-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jens Geyer (Jira)" <j...@apache.org>
Subject [jira] [Commented] (THRIFT-4930) An information leakage about socket input stream or output stream from TIOStreamTransport to TSocket
Date Wed, 11 Sep 2019 21:42:00 GMT

    [ https://issues.apache.org/jira/browse/THRIFT-4930?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16928025#comment-16928025
] 

Jens Geyer commented on THRIFT-4930:
------------------------------------

Whatever makes most sense to you will be probably fine.

> An information leakage about socket input stream or output stream from TIOStreamTransport
to TSocket
> ----------------------------------------------------------------------------------------------------
>
>                 Key: THRIFT-4930
>                 URL: https://issues.apache.org/jira/browse/THRIFT-4930
>             Project: Thrift
>          Issue Type: Bug
>          Components: Java - Library
>    Affects Versions: 0.11.0, 0.12.0
>         Environment: 	Ubuntu 16.04.3 LTS
> 	Open JDK version "1.8.0_191" build 25.191-b12
>            Reporter: xiaoqin.fu
>            Priority: Major
>         Attachments: TaintPath
>
>
>    Operations: During Apache Thrift integration testing, I developed a calculator application
with a client and a server. The client sent a computational command and get the result from
the server. After I applied dynamic taint analyzer (distTaint), I found bugs from taint paths
finally.
>   The source: org.apache.thrift.transport.TIOStreamTransport:
>     public int read(byte[] buf, int off, int len) throws TTransportException {
>     if (inputStream_ == null) {
>       throw new TTransportException(TTransportException.NOT_OPEN, "Cannot read from null
inputStream");
>     }
>     int bytesRead;
> 	......
>       bytesRead = inputStream_.read(buf, off, len);
> 	......
>   }
>   The sink: org.apache.thrift.transport.TSocket:
>   public void close() {
> 	......
>     if (socket_ != null) {
>       try {
>         socket_.close();
>       } catch (IOException iox) {
>         LOGGER.warn("Could not close socket.", iox);
>       }
>       socket_ = null;
>     }
>   }
> Sensitive information about socket input stream or output stream is leaked.
>   The taint path:
> org.apache.thrift.transport.TIOStreamTransport --> 
>    org.apache.thrift.transport.TTransport --> 
>     org.apache.thrift.protocol.TBinaryProtocol --> 
>     org.apache.thrift.transport.TTransport --> 
>      org.apache.thrift.protocol.TBinaryProtocol --> 
>      org.apache.thrift.transport.TTransport --> 
>      org.apache.thrift.protocol.TBinaryProtocol --> 
>      org.apache.thrift.transport.TTransport --> 
>       org.apache.thrift.protocol.TBinaryProtocol --> 
>       org.apache.thrift.transport.TTransport --> 
>       org.apache.thrift.protocol.TBinaryProtocol --> 
>       org.apache.thrift.transport.TTransport --> 
>       org.apache.thrift.protocol.TBinaryProtocol --> 
>       org.apache.thrift.transport.TTransport --> 
>       CalculatorService$add_result$add_resultStandardScheme --> 
>        org.apache.thrift.protocol.TBinaryProtocol --> 
>        org.apache.thrift.TServiceClient --> 
>        org.apache.thrift.protocol.TBinaryProtocol --> 
>        org.apache.thrift.transport.TIOStreamTransport --> 
>        CalculatorService$add_result$add_resultStandardScheme --> 
>        org.apache.thrift.protocol.TBinaryProtocol --> 
>        org.apache.thrift.transport.TIOStreamTransport --> 
>        CalculatorService$add_result$add_resultStandardScheme --> 
>        org.apache.thrift.protocol.TBinaryProtocol --> 
>         CalculatorService$Client --> 
>         org.apache.thrift.protocol.TMessage --> 
>         org.apache.thrift.protocol.TField --> 
>         org.apache.thrift.protocol.TBinaryProtocol --> 
>         CalculatorService$add_result$add_resultStandardScheme --> 
>         org.apache.thrift.protocol.TBinaryProtocol --> 
>         CalculatorService$add_result$add_resultStandardScheme --> 
>         org.apache.thrift.protocol.TBinaryProtocol --> 
>         org.apache.thrift.protocol.TField --> 
>         CalculatorService$Client --> 
>         org.apache.thrift.protocol.TBinaryProtocol --> 
>         CalculatorService$add_result --> 
>         org.apache.thrift.TServiceClient --> 
>         org.apache.thrift.protocol.TBinaryProtocol --> 
>         org.apache.thrift.TServiceClient --> 
>         org.apache.thrift.protocol.TField --> 
>          CalculatorService$add_result$add_resultStandardScheme --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          CalculatorService$Client --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          CalculatorService$Client --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          org.apache.thrift.protocol.TMessage --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          org.apache.thrift.TServiceClient --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          org.apache.thrift.TServiceClient --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          CalculatorService$add_result$add_resultStandardScheme --> 
>          org.apache.thrift.protocol.TBinaryProtocol --> 
>          org.apache.thrift.protocol.TMessage --> 
>          CalculatorService$add_result$add_resultStandardScheme --> 
>           CalculatorService$add_args --> 
>           org.apache.thrift.protocol.TBinaryProtocol --> 
>           CalculatorService$add_result --> 
>           CalculatorService$add_args --> 
>           org.apache.thrift.TServiceClient --> 
>           CalculatorService$add_result --> 
>           org.apache.thrift.protocol.TBinaryProtocol --> 
>           CalculatorService$add_args --> 
>           CalculatorService$add_result$add_resultStandardScheme --> 
>           CalculatorService$add_result --> 
>           org.apache.thrift.EncodingUtils --> 
>           CalculatorClient --> 
>           CalculatorService$add_result --> 
>           org.apache.thrift.protocol.TBinaryProtocol --> 
>           org.apache.thrift.TServiceClient --> 
>           org.apache.thrift.protocol.TBinaryProtocol --> 
>           CalculatorService$add_result --> 
>           org.apache.thrift.protocol.TBinaryProtocol --> 
>           org.apache.thrift.EncodingUtils --> 
>           org.apache.thrift.protocol.TBinaryProtocol --> 
>           org.apache.thrift.EncodingUtils --> 
>            org.apache.thrift.protocol.TBinaryProtocol --> 
>            org.apache.thrift.EncodingUtils --> 
>            CalculatorService$add_args --> 
>            CalculatorService$add_args$add_argsStandardSchemeFactory --> 
>            CalculatorClient --> 
>            org.apache.thrift.protocol.TBinaryProtocol --> 
>            CalculatorService$add_result$add_resultStandardSchemeFactory --> 
>            CalculatorService$add_result --> 
>             org.apache.thrift.protocol.TBinaryProtocol --> 
>             CalculatorClient --> 
>             org.apache.thrift.protocol.TBinaryProtocol --> 
>             CalculatorService$add_args --> 
>             org.apache.thrift.protocol.TBinaryProtocol --> 
>             CalculatorService$add_args --> 
>             org.apache.thrift.protocol.TBinaryProtocol --> 
>             CalculatorClient --> 
>             CalculatorService$add_result --> 
>              org.apache.thrift.protocol.TBinaryProtocol --> 
>              org.apache.thrift.transport.TSocket 
> I am going to submit a CVE, so please confirm this is not a true positive.



--
This message was sent by Atlassian Jira
(v8.3.2#803003)

Mime
View raw message