Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x-pack/auditbeat/module/system/socket: defend against exec with zero arguments #30586

Merged
merged 1 commit into from
Feb 28, 2022
Merged

x-pack/auditbeat/module/system/socket: defend against exec with zero arguments #30586

merged 1 commit into from
Feb 28, 2022

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Feb 28, 2022

What does this PR do?

This change defends against a bounds panic when execve has been called with an argv with zero arguments; exexve can have a zero-length argv so fall back to using /proc/comm, or path base.

Why is it important?

It is possible for a zero argument execve call to result in a bounds check error when attempting to get the process name for the exec'd process, panicking and bringing down the auditbeat process.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

@efd6 efd6 added bug Auditbeat Team:Security-External Integrations backport-v8.0.0 Automated backport with mergify 8.2-candidate backport-v8.1.0 Automated backport with mergify backport-7.17 Automated backport to the 7.17 branch with mergify labels Feb 28, 2022
@efd6 efd6 requested a review from a team as a code owner February 28, 2022 02:22
@efd6 efd6 self-assigned this Feb 28, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Feb 28, 2022
@elasticmachine
Copy link
Collaborator

elasticmachine commented Feb 28, 2022 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-02-28T08:42:44.814+0000

  • Duration: 73 min 1 sec

Test stats 🧪

Test Results
Failed 0
Passed 297
Skipped 97
Total 394

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@efd6
x-pack/auditbeat/module/system/socket: defend against exec with zero …
aa7298f 
…arguments

execve can have a zero-length argv so fall back to using /proc/comm, or path base.
adriansr
adriansr approved these changes Feb 28, 2022
View reviewed changes
Copy link
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for fixing

@efd6 efd6 merged commit 37d07d1 into elastic:main Feb 28, 2022
@efd6 efd6 deleted the auditsocketbang branch February 28, 2022 12:20
mergify bot pushed a commit that referenced this pull request Feb 28, 2022
@efd6
x-pack/auditbeat/module/system/socket: defend against exec with zero …
382ad28 
…arguments (#30586)

execve can have a zero-length argv so fall back to using /proc/comm, or path base.

(cherry picked from commit 37d07d1)
@mergify mergify bot mentioned this pull request Feb 28, 2022
Merged
mergify bot pushed a commit that referenced this pull request Feb 28, 2022
@efd6
x-pack/auditbeat/module/system/socket: defend against exec with zero …
657fa42 
…arguments (#30586)

execve can have a zero-length argv so fall back to using /proc/comm, or path base.

(cherry picked from commit 37d07d1)
@mergify mergify bot mentioned this pull request Feb 28, 2022
Merged
mergify bot pushed a commit that referenced this pull request Feb 28, 2022
@efd6
x-pack/auditbeat/module/system/socket: defend against exec with zero …
57dc534 
…arguments (#30586)

execve can have a zero-length argv so fall back to using /proc/comm, or path base.

(cherry picked from commit 37d07d1)
@mergify mergify bot mentioned this pull request Feb 28, 2022
Merged
efd6 added a commit that referenced this pull request Feb 28, 2022
@mergify @efd6
x-pack/auditbeat/module/system/socket: defend against exec with zero …
216b1ab 
…arguments (#30586) (#30597)

execve can have a zero-length argv so fall back to using /proc/comm, or path base.

(cherry picked from commit 37d07d1)

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
efd6 added a commit that referenced this pull request Mar 1, 2022
@mergify @efd6
[8.0](backport #30586) x-pack/auditbeat/module/system/socket: defend …
6425173 
…against exec with zero arguments (#30596)

* x-pack/auditbeat/module/system/socket: defend against exec with zero arguments (#30586)

execve can have a zero-length argv so fall back to using /proc/comm, or path base.

(cherry picked from commit 37d07d1)

* Update CHANGELOG.next.asciidoc

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
efd6 added a commit that referenced this pull request Mar 1, 2022
@mergify @efd6
[7.17](backport #30586) x-pack/auditbeat/module/system/socket: defend…
32d9574 
… against exec with zero arguments (#30595)

* x-pack/auditbeat/module/system/socket: defend against exec with zero arguments (#30586)

execve can have a zero-length argv so fall back to using /proc/comm, or path base.

(cherry picked from commit 37d07d1)

* Update CHANGELOG.next.asciidoc

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
v1v added a commit that referenced this pull request Mar 2, 2022
@v1v
Merge branch '8.1' of github.com:elastic/beats into mergify/bp/8.1/pr…
0112148 
…-29710

* '8.1' of github.com:elastic/beats: (51 commits)
  refactor pushDockerImages (#30414) (#30624)
  ci: add windows-2022 in the extended meta-stage (#30528) (#30630)
  Curate k8s testing versions to only keep the actively maintained (#30619) (#30625)
  [8.1](backport #30355) Add Beats upgrade docs for 8.0 (#30612)
  Remove references to gcp from the Functionbeat docs (#30579) (#30609)
  x-pack/auditbeat/module/system/socket: defend against exec with zero arguments (#30586) (#30597)
  [MySQL Enterprise] Adding default paths values to manifest.yml (#30598) (#30604)
  metricbeat - fix elasticsearch and kibana integration tests failures in 8.0 (#30566) (#30594)
  Install gawk as a replacement for mawk in Docker containers. (#30452) (#30465)
  [Filebeat] Remove RecordedFuture dataset from Threat Intel module (#30564) (#30568)
  Adjust the documentation of `backoff` options in filestream input (#30552) (#30557)
  packetbeat/beater: help the GC clean up the Npcap installer if it's not used (#30513) (#30546)
  Osquerybeat: Add install verification for osquerybeat (#30388) (#30404)
  Update docker/distribution to 2.8.0 (#30462) (#30540)
  Add `parsers` examples to `filestream` reference configuration (#30529) (#30537)
  [8.1](backport #30068) ZooKeeper module: Adapt to ZooKeeper 3.6+ `mntr` response fields' changes. (#30360)
  [8.1](backport #30512) Switch skip to use `CI` (#30525)
  Forward-port 8.0.1 changelog to 8.1 (#30517)
  packetbeat/beater: don't attempt to install npcap when already installed (#30509) (#30511)
  Add drop and explicit tests to avoid duplicate ingest of elasticsearch logs (#30440) (#30488)
  ...
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers

@adriansr adriansr adriansr approved these changes

Assignees

@efd6 efd6

Labels
8.2-candidate Auditbeat backport-7.17 Automated backport to the 7.17 branch with mergify backport-v8.0.0 Automated backport with mergify backport-v8.1.0 Automated backport with mergify bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

x-pack/auditbeat/module/system/socket: panic in (*execveCall).getProcess when execve has zero arguments
3 participants
@efd6 @elasticmachine @adriansr