On Fri, Dec 02, 2016 at 06:59:32PM -0500, Matt Coleman wrote:
I feel a conservative approach would be to increase the limits to approximately 1.5 times the largest observed counts:
• If we decide to go with the values observed from just the 'Microsoft\Windows NT\CurrentVersion' key in our cloud, then HIVEX_MAX_SUBKEYS would become 70000 and HIVEX_MAX_VALUES would become 55000. These are the initial values I was going to base my patch on, since (selfishly) that's all my code cares about, but I figured it makes more sense to account for all regions of the hive.
This is reasonable and safe.
• If we decide to go with the values from the whole software hive, then HIVEX_MAX_SUBKEYS would become 3600000 and HIVEX_MAX_VALUES would become 110000. These are the values I used in the attached patch. The only thing that makes me hesitant is that they're both so significantly larger than the current limits.
These are getting rather large. As discussed on IRC if we're going for this kind of approach I would rather that the limits were made completely configurable through the API, so that callers who know what they're doing can increase them (or even remove them), while those that don't won't get bitten by a malicious hive that causes a denial of service.
What about removing the limits entirely? The registry format allows up to 2^32 subkeys and values. On IRC, rwmjones said, "the limits are there to stop malicious hives from using too much memory". I hadn't heard of malicious hives before. Have there been exploits that leveraged this, or is it just being cautious about a potential threat?
We are very much concerned about malicious hives because tools built on top of hivex (such as libguestfs) are frequently run against untrusted guests, eg in cloud situations like OpenStack. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/