COVESA / COVESA/vsomeip

[BUG][Security]: Routing credentials not enforced if specified using the non-deprecated format in the configuration file

Open
#1,016 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C++
Stars
1.4k
Forks
826
PR merge metrics
No merged PRs in 30d

Description

### vSomeip Version

v3.5.4

### Boost Version

N/A

### Environment

Embedded Linux

### Describe the bug

If specifying the routing credentials using the new, current format, using the '/routing/host/uid' and the '/routing/host/gid' keys, the credentials are not really enforced as it will allow the connection, falling back to 'audit mode', as shown in the picture below:

Image

If specifying the routing credentials using the old, deprecated format, using the '/routing-credentials/uid' and the '/routing-credentials/gid' keys in the JSON configuration file, these credentials are enforced, as shown in the picture below:

Image

The relevant code performing this check is:

Image

I believe the issue is, that the 'check_routing_credentials_' flag, is only set when the routing credentials are loaded using the old format:

Image

And left unset if using the new format:

Image

Although this is something that was tested in v3.5.4 on my side, I believe this to be reproducible in the last version too (the pics currently refer to the master branch), and versions previous to v3.5.4.

It can be relatively substantial security gap that might be affecting multiple releases. In principle any application will be able to connect regardless of configured / actual routing security credentials in the routing manager, as, on error, the check will fallback to audit mode and allow the connection.

### Reproduction Steps

Simply use the new format of routing credentials to specify the UID and GID. On error, the connection is still allowed as it wrongly falls back into audit mode.

### Expected behaviour

New format expectations should match old format expectations.

### Logs and Screenshots

Already explained in detail in description of the bug.

Contributor guide

Open the contributing guide

Research direction

Start by tracing routing credential loading for /routing/host/uid and /routing/host/gid, then compare it with the deprecated /routing-credentials/uid and /routing-credentials/gid path and the check_routing_credentials_ flag. Reproduce the mismatch with incorrect credentials and verify that the new format rejects the connection instead of falling back to audit mode.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.