Security Reporting

[Fabian-Gruenbichler]

Hi,

I recently (>1 week ago) filed an issue using GH's builtin security reporting feature, but haven't heard back yet at all. So I wonder - is that not the right place to report? Is anybody monitoring incoming reports there? Even a short "thanks, will take a look sometime soonish" would alleviate my fear that I am talking to the void ;)

If it's not the right place to report those, I'd appreciate a pointer where to report them (and also would suggest disabling that feature on the GH side ;)).

Thanks!

[gmelikov]

@behlendorf @ahrens

[Fabian-Gruenbichler]

also, no matter which avenue is preferred in the future for reporting potentially security relevant issues - a spelled out policy what kind of boundaries and types of issues you consider relevant for private reporting would also be great. this is especially tricky for file systems of course (with the almost endless source of trouble being intentionally or accidentally malformed/corrupted on-disk structures), but something along the lines of

• userspace tools as unpriv user (e.g., zfs list crashing with a UAF, or zfs list triggering a kernel NULL deref, ..)
• userspace tools as root (same, but also covering commands that are root only or need to be zfs allowed)
• other userspace interactions (such as ZFS control dir, the ioctl interface, ..)
• I/O (issues triggerable by doing (potentially weird) I/O on a ZFS dataset)
• zfs program input (e.g., the recent LUA CVE)
• zfs recv input (! this one is probably one of the most interesting attack surfaces in the context of ZFS - by virtue of its nature, it often has to be exposed to fairly untrusted sources, and there is lots of corner cases that might trigger corruption that can be used to trip up code in kernel space afterwards)
• zed
• zdb

with descriptions of where you consider security boundaries to exist or not might help.

[Fabian-Gruenbichler]

still haven't heard back either here or in the report itself -> I'll just open a public issue/PR start of next week since the actual bug that prompted all of this is not that critical. I'd still appreciate some sort of response ;)

[Fabian-Gruenbichler]

#16006