grafana / grafana/pyroscope-dotnet
Fix IPC server fail-open after named pipe creation failure
- Dominant language
- C++
- Stars
- 38
- Forks
- 13
- Avg merge
- 20h 15m
- Merged PRs (30d)
- 10
Description
## Problem
The named-pipe hardening introduced in [PR #404](https://github.com/grafana/pyroscope-dotnet/pull/404) uses `FILE_FLAG_FIRST_PIPE_INSTANCE`, but a pipe creation failure is not propagated to the caller.
`IpcServer::StartCallback()` signals initialization after `CreateNamedPipeA()` fails, while `IpcServer::StartAsync()` still returns a non-null server. `EtwEventsManager::Start()` consequently registers the process ID with the Agent, which may then connect to an already-existing, attacker-controlled pipe.
This preserves the endpoint-hijacking and profiling-denial scenario that the hardening is intended to prevent.
## Expected behavior
- Propagate named-pipe creation failure from `StartAsync()`.
- Do not register the process with the Agent unless the profiler owns a successfully created server pipe.
- Add coverage for `FILE_FLAG_FIRST_PIPE_INSTANCE`/pipe-name collision failure.
Contributor guide
No contributing guide indexed for this repository
Research direction
Trace IpcServer::StartAsync() and IpcServer::StartCallback(), beginning with the CreateNamedPipeA() failure path and the FILE_FLAG_FIRST_PIPE_INSTANCE behavior. Check how EtwEventsManager::Start() registers the process with the Agent, then add coverage for pipe-name collision failure; done means creation errors propagate, no non-null server is returned, and registration does not occur.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100