Vulnerability in Qubes RPC implementation accepted

THREATQW44 · Accepted: The team has decided to live with this risk. · Defined in catalog.py:3639

Risk: High impact × Very Low likelihood = 3 low
After mitigations: High impact × Very Low likelihood = 3 low (unchanged)

A vulnerability in the storing or processing of default RPC policies within Qubes would allow an attacker to pivot accross domains and perform actions on other VMs.

Mitigations

No mitigations in place.

Where it applies

Applies to 1 component in 1 scenario.

Qubes OS and Xen SecureDrop Workstation

Workstation: boot, provisioning and updates · Qubes OS and Xen

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

        }

        component_Qubes_OS_and_Xen_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Qubes OS and Xen";
            URL = "component_Qubes_OS_and_Xen.html";
            tooltip = "Qubes OS and Xen";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Workstation_bootloader_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nbootloader";
            URL = "component_Workstation_bootloader.html";
            tooltip = "Workstation bootloader";
            margin = 0.02;
        ]

        component_Workstation_firmware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nfirmware";
            URL = "component_Workstation_firmware.html";
            tooltip = "Workstation firmware";
            margin = 0.02;
        ]

        component_Workstation_hardware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nhardware";
            URL = "component_Workstation_hardware.html";
            tooltip = "Workstation hardware";
            margin = 0.02;
        ]

        component_Workstation_provisioning_code_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nprovisioning\ncode";
            URL = "component_Workstation_provisioning_code.html";
            tooltip = "Workstation provisioning code";
            margin = 0.02;
        ]

        component_dom0_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "dom0";
            URL = "component_dom0.html";
            tooltip = "dom0";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Workstation_hardware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "1. Power on";    ]
    component_Workstation_hardware_SecureDrop_Workstation -> component_Workstation_firmware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "2. Start firmware";    ]
    component_Workstation_firmware_SecureDrop_Workstation -> component_Workstation_bootloader_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "3. Load bootloader";    ]
    component_Workstation_bootloader_SecureDrop_Workstation -> component_Qubes_OS_and_Xen_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "4. Boot Qubes";    ]
    component_Qubes_OS_and_Xen_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "5. Start dom0";    ]
    actor_Administrator_ -> component_Workstation_provisioning_code_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "6. Install and\nconfigure";    ]
    component_Workstation_provisioning_code_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apply salt states";    ]
    component_dom0_SecureDrop_Workstation -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Provide secret\nkeys";    ]
    component_dom0_SecureDrop_Workstation -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "9. Fetch updates";    ]
    component_FPF_apt_repository_External_Services -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signed packages";    ]
}

Notes

In scope for audit: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.