A bug in Starwind StarLVM plugin when making a snapshot on ProxmoxVE with Include RAM enabled

[nvanaert]

image.png (18.12 KiB) Viewed 5115 times

There's one statement, inserted in alloc_image right after $psize = $psize - $free; in /usr/share/perl5/PVE/Storage/Custom/StarLvmPlugin.pm.

A suggested fix for the issue (by Claude and seems to be working):

Code: Select all

          if ($free < $psize) {
              $psize = $psize - $free;
              # untaint: $free is derived from `lvs` output, so $psize is tainted and
              # PVE's daemons run under perl -T. int() does NOT untaint - only a regex
              # capture does. Without this, run_command() dies in IPC::Open3.
              ($psize) = ($psize =~ /^(\d+)(?:\.\d+)?$/)
                  or die "unexpected thin pool extend size for '$vg/$pool'\n";
              $cmd = ['/sbin/lvresize', '-L', "+${psize}k", "$vg/$pool"];
              run_command($cmd, errmsg => "lvresize thin pool '$vg/$pool' to ${psize}k error");
          }

A regex capture is the only thing that clears Perl it's taint flag normally, which is exactly what the int() wrapper fails to do. The optional (?:\.\d+)? group truncates rather than dying if a build ever hands it a float — in 1.1.41 $psize is always integer KiB, so it's belt-and-braces.

Claude's test results:
I've verified it end to end, not just asserted:

in=84398080 -> psize=23580672 tainted=NO exec OK
in=84398080.5 -> psize=23580672 tainted=NO exec OK

Same code path that died with Insecure dependency in exec before the patch.

[yaroslav (staff)]

Thanks for reporting. Could you please also share the proxmox version that you are using?

[yaroslav (staff)]

My colleagues were unable to reproduce the issue.
Please tell me more about
-hardware you use and the storage that is backed by StarLVM (hardware, protocol it is connected with).
-Proxmox version.
-Plugin version.

Thanks!

[rhp]

We are experiencing this exact same issue.
It seems that the StarLvmPlugin.pm is missing some untainting calls.
At the moment we have patched the file to include this (similar to the original poster), but it would be better if this is included in a next release of the StarLvmPlugin.pm module.

We can provide the patched file if so requested.

[yaroslav (staff)]

Thanks for your update.

Please tell me more about
-hardware you use and the storage that is backed by StarLVM (hardware, protocol it is connected with).
-Proxmox version.
-Plugin version.

[rhp]

We are using Proxmox VE 9.2.4 with starwind-proxmox-plugin-pve9 1.1.41.
The connection to the underlying storage is over iSCSI to a Dell EqualLogic storage array.

[yaroslav (staff)]

Thanks.