grafana / grafana/pyroscope-dotnet

Fix IPC server fail-open after named pipe creation failure

Open
#407 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
38
Forks
13
Avg merge
20h 15m
Merged PRs (30d)
10

Description

## Problem

The named-pipe hardening introduced in [PR #404](https://github.com/grafana/pyroscope-dotnet/pull/404) uses `FILE_FLAG_FIRST_PIPE_INSTANCE`, but a pipe creation failure is not propagated to the caller.

`IpcServer::StartCallback()` signals initialization after `CreateNamedPipeA()` fails, while `IpcServer::StartAsync()` still returns a non-null server. `EtwEventsManager::Start()` consequently registers the process ID with the Agent, which may then connect to an already-existing, attacker-controlled pipe.

This preserves the endpoint-hijacking and profiling-denial scenario that the hardening is intended to prevent.

## Expected behavior

- Propagate named-pipe creation failure from `StartAsync()`.
- Do not register the process with the Agent unless the profiler owns a successfully created server pipe.
- Add coverage for `FILE_FLAG_FIRST_PIPE_INSTANCE`/pipe-name collision failure.

Contributor guide

No contributing guide indexed for this repository

Research direction

Trace IpcServer::StartAsync() and IpcServer::StartCallback(), beginning with the CreateNamedPipeA() failure path and the FILE_FLAG_FIRST_PIPE_INSTANCE behavior. Check how EtwEventsManager::Start() registers the process with the Agent, then add coverage for pipe-name collision failure; done means creation errors propagate, no non-null server is returned, and registration does not occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.