Repository navigation
fix(dstack-mr): bound the PE header region before hashing it - #1231
Merged
Merged
Conversation
This was referenced Sep 20, 2026
kvinwang
added a commit
that referenced
this pull request
Sep 25, 2026
… parser bounds #1387 requires PCI hotplug off for GPU passthrough, so the matrix GPU row failed; measure it with hotplug off and assert the named rejection without. #1229 reads XLF bit 1, not bit 6, for the initrd ceiling: fix the harness oracle and add a row with a 5-level-only kernel. #1367 made diagnose honour num_nics, num_verity_volumes and swtpm; compare it with measure. Run the new dstack-mr and dstack-types bound vectors from #1229, #1231, #1236 and Signed-off-by: Kevin Wang <wy721@qq.com> #1275 by exact name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
authenticode_sha384_hash(dstack-mr/src/kernel.rs) usedSizeOfHeadersand the certificate-directory offset, both read from the image, as slice bounds without checking them. ASizeOfHeaderspast the image, smaller than the cert directory end, or a PE truncated before the cert directory panics (range end index 4294967280 out of range for slice of length 8192). Release builds arepanic = "abort"and the measurement runs in-process in the verifier/KMS, so a malformed image aborts the service instead of failing one measurement.Not attacker-reachable in practice: images are content-addressed (
sha256sum.txthash ==os_image_hash, gated by the on-chain whitelist) before parsing. This guards against a malformed published image. Reported as GHSA-wgq9-5x6m-wg2w.Fix
Check
cert_dir_end <= size_of_headers <= data.len()before slicing, which also covers the two earlier slices.Verification
kernel.rs:56without the fix, passes with it;cargo test -p dstack-mr30 passed.measure-osoutput is byte-identical before/after on 6 real OS images (real kernels:SizeOfHeaders0x400,cert_dir_end232).