Known vulnerability in any VM template mitigated

THREATQW22 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:3323

Risk: High impact × High likelihood = 12 high
After mitigations: High impact × Low likelihood = 6 medium

A known vulnerability in the template VM is exploited by an attacker. Any VM using the template would contain the vulnerable package.

Threat actors: Nation State / Law Enforcement Large Corporation Developer error

Mitigations

Mitigation	Status
Autoupdate all VMs MITIGQW1	implemented
grsecurity in all Debian templates MITIGQW3	implemented

Residual risk

AppVMs that have not been rebooted do not have updates applied. TemplateVMs must have upstream support (e.g. receive security fixes). Custom grsecurity-hardened kernels must be built and updated by FPF.

Where it applies

Applies to 9 components in 3 scenarios.

sd-app (SecureDrop Client) Workstation VMs
sd-devices (export and print) Workstation VMs
sd-gpg Workstation VMs
sd-log Workstation VMs
sd-proxy Workstation VMs
sd-viewer (disposable VMs) Workstation VMs
sys-firewall Workstation VMs
sys-net Workstation VMs
sys-usb Workstation VMs

Workstation: reading submissions · sd-app (SecureDrop Client), sd-proxy, sys-firewall, sys-net, sd-gpg, sd-viewer (disposable VMs), sd-log

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_proxy_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-proxy";
                URL = "component_sd_proxy.html";
                tooltip = "sd-proxy";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sys_firewall_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-firewall";
                URL = "component_sys_firewall.html";
                tooltip = "sys-firewall";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sys_net_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-net";
                URL = "component_sys_net.html";
                tooltip = "sys-net";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

        }

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Use the client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_proxy_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist API\nrequest";    ]
    component_sd_proxy_Workstation_VMs -> component_sys_firewall_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Route via\nfirewall";    ]
    component_sys_firewall_Workstation_VMs -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "4. Route to network";    ]
    component_sys_net_Workstation_VMs -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reach the\nJournalist Interface";    ]
    component_Journalist_Interface_Application_Server -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Encrypted\nsubmissions";    ]
    component_sd_proxy_Workstation_VMs -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "7. Relay to client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Decrypt";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "9. Open a file";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "10. Send logs";    ]
}

Workstation: export and print · sd-app (SecureDrop Client), sd-devices (export and print), sys-usb, sd-viewer (disposable VMs), sd-log

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_devices__export_and_print__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-devices\n(export and\nprint)";
                URL = "component_sd_devices__export_and_print_.html";
                tooltip = "sd-devices (export and print)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

            component_sys_usb_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-usb";
                URL = "component_sys_usb.html";
                tooltip = "sys-usb";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

        }

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Choose export";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_devices__export_and_print__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Hand file to\nexport VM";    ]
    component_sys_usb_Workstation_VMs -> component_sd_devices__export_and_print__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Attach USB device";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Write to drive";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "5. Preview in\ndisposable VM";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Send logs";    ]
}

Workstation: boot, provisioning and updates · sd-gpg

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;

                style = "filled";

                fillcolor = "#c0392b";

                fontcolor = "white";

                class = "highlighted";
            ]

        }

        component_Qubes_OS_and_Xen_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Qubes OS and Xen";
            URL = "component_Qubes_OS_and_Xen.html";
            tooltip = "Qubes OS and Xen";
            margin = 0.02;
        ]

        component_Workstation_bootloader_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nbootloader";
            URL = "component_Workstation_bootloader.html";
            tooltip = "Workstation bootloader";
            margin = 0.02;
        ]

        component_Workstation_firmware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nfirmware";
            URL = "component_Workstation_firmware.html";
            tooltip = "Workstation firmware";
            margin = 0.02;
        ]

        component_Workstation_hardware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nhardware";
            URL = "component_Workstation_hardware.html";
            tooltip = "Workstation hardware";
            margin = 0.02;
        ]

        component_Workstation_provisioning_code_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nprovisioning\ncode";
            URL = "component_Workstation_provisioning_code.html";
            tooltip = "Workstation provisioning code";
            margin = 0.02;
        ]

        component_dom0_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "dom0";
            URL = "component_dom0.html";
            tooltip = "dom0";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Workstation_hardware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "1. Power on";    ]
    component_Workstation_hardware_SecureDrop_Workstation -> component_Workstation_firmware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "2. Start firmware";    ]
    component_Workstation_firmware_SecureDrop_Workstation -> component_Workstation_bootloader_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "3. Load bootloader";    ]
    component_Workstation_bootloader_SecureDrop_Workstation -> component_Qubes_OS_and_Xen_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "4. Boot Qubes";    ]
    component_Qubes_OS_and_Xen_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "5. Start dom0";    ]
    actor_Administrator_ -> component_Workstation_provisioning_code_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "6. Install and\nconfigure";    ]
    component_Workstation_provisioning_code_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apply salt states";    ]
    component_dom0_SecureDrop_Workstation -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Provide secret\nkeys";    ]
    component_dom0_SecureDrop_Workstation -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "9. Fetch updates";    ]
    component_FPF_apt_repository_External_Services -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signed packages";    ]
}

Notes

Existing mitigations: - Template packages are updated prior to starting the SecureDrop App. Once the update is complete, the user will prompted to reboot to apply updates if any dom0 updates were found. - Grsecurity hardened kernels used in critical VM templates (MITIGQW3). Further mitigations: - Updater GUI informs and prompts user to restart AppVMs or entire workstation. - Provide end-user documentation informing them that an Internet connection and reboot are required to ensure package updates.

How this threat is matched

Listed for these components. A boundary covers every component inside it.