Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-39547

Corrupt node jar cache causes node to malfunction

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      Remoting does not check whether the cached file's checksum matches before using it[1]. User with build permission can use this to inject new classes or different class implementations/resource content manipulating the cache and waiting for agent to restart.

      This can be used for denial of service attack against nodes as they will connect to Jenkins correctly but refuse to fulfill remoting requests with strange exceptions.

      More sophisticated attack can trick agent to execute custom code and therefore produce incorrect results, try to abuse existing {{SlaveToMasterCallable}}s or generate malicious files/reports to be published on masters.

      There do not seem to be a way to load those classes to master JVM or send new callable there if slave2master security is on, AFAIK.

      [1] https://github.com/jenkinsci/remoting/blob/0d8a2af7cffa6aa5a6f2675e810b286a984af04e/src/main/java/hudson/remoting/FileSystemJarCache.java#L65-70

        Attachments

          Issue Links

            Activity

            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Oliver Gondža
            Path:
            src/main/java/hudson/remoting/Checksum.java
            src/main/java/hudson/remoting/FileSystemJarCache.java
            src/main/java/hudson/remoting/JarLoaderImpl.java
            src/test/java/hudson/remoting/ChecksumTest.java
            src/test/java/hudson/remoting/FileSystemJarCacheTest.java
            http://jenkins-ci.org/commit/remoting/cdd5bce5725d338b129c63c22b8e6a132e77865c
            Log:
            JENKINS-39547 - Corrupt jar cache (#130)

            • Do not cache by URL
            • Do not perform Checksum caching in Checksum class

            We need a way to calculate reliable checksums and as implemented it causes
            temporary write-then-move files to have checksums cached never to use used.

            • [FIXED JENKINS-39547] Verify cached slave jars before using them.

            This moves checksum caching to FileSystemJarCache.

            • Address review comments
            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oliver Gondža Path: src/main/java/hudson/remoting/Checksum.java src/main/java/hudson/remoting/FileSystemJarCache.java src/main/java/hudson/remoting/JarLoaderImpl.java src/test/java/hudson/remoting/ChecksumTest.java src/test/java/hudson/remoting/FileSystemJarCacheTest.java http://jenkins-ci.org/commit/remoting/cdd5bce5725d338b129c63c22b8e6a132e77865c Log: JENKINS-39547 - Corrupt jar cache (#130) Do not cache by URL Do not perform Checksum caching in Checksum class We need a way to calculate reliable checksums and as implemented it causes temporary write-then-move files to have checksums cached never to use used. [FIXED JENKINS-39547] Verify cached slave jars before using them. This moves checksum caching to FileSystemJarCache. Address review comments
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Oleg Nenashev
            Path:
            pom.xml
            http://jenkins-ci.org/commit/jenkins/ef588be4f264b5ba285110f472f031e2bd771c71
            Log:
            Update Jenkins remoting to 3.3 (#2671)

            • JENKINS-25218 - Hardening of FifoBuffer operation logic. The change improves the original fix in `remoting-2.54`.
            • JENKINS-39547 - Corrupt agent JAR cache causes agents to malfunction.

            Improvements:

            • JENKINS-40491 - Improve diagnostincs of the preliminary FifoBuffer termination.
            • ProxyException now retains any suppressed exceptions.
            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/jenkins/ef588be4f264b5ba285110f472f031e2bd771c71 Log: Update Jenkins remoting to 3.3 (#2671) JENKINS-25218 - Hardening of FifoBuffer operation logic. The change improves the original fix in `remoting-2.54`. JENKINS-39547 - Corrupt agent JAR cache causes agents to malfunction. Improvements: JENKINS-40491 - Improve diagnostincs of the preliminary FifoBuffer termination. ProxyException now retains any suppressed exceptions.
            Hide
            oleg_nenashev Oleg Nenashev added a comment -

            Released in jenkins-2.37, marking as LTS candidate

            Show
            oleg_nenashev Oleg Nenashev added a comment - Released in jenkins-2.37, marking as LTS candidate
            Hide
            olivergondza Oliver Gondža added a comment -

            I did not have a time to get the tests to work https://github.com/jenkinsci/jenkins/pull/2620.
            Postponing for now.

            Show
            olivergondza Oliver Gondža added a comment - I did not have a time to get the tests to work https://github.com/jenkinsci/jenkins/pull/2620 . Postponing for now.
            Hide
            olivergondza Oliver Gondža added a comment -

            Expedited to 2.32.2 together with security fixes.

            Show
            olivergondza Oliver Gondža added a comment - Expedited to 2.32.2 together with security fixes.

              People

              • Assignee:
                olivergondza Oliver Gondža
                Reporter:
                olivergondza Oliver Gondža
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: