Penetration Test Report (Atredis): Final Atredis Agoric API Kernel Assessment Report V1.1

Agoric
Kernel API Assessment
Security Assessment Report
Project Team:
Technical Testing Jordan Whitehead and Loren
Browman
Prepared for Agoric Systems
Operating Company Technical Editing Darren Kemp and Joshua Vaughn
September 21, 2022 (version 1.1) Project Management Sara Bettes
Atredis Partners www.atredis.com
Atredis Partners ⚫ Bene Diagnoscitur, Bene Curatur Confidential ⚫ For Intended Recipient Only
Atredis Partners – Agoric Kernel API Assessment
Table of Contents
Engagement Overview ............................................................................................... 3
Assessment Components and Objectives ................................................................. 3
Engagement Tasks ..................................................................................................... 4
Runtime Analysis ................................................................................................. 4
Source Code Analysis ........................................................................................... 4
Configuration and Architecture Review .................................................................... 4
Executive Summary ................................................................................................... 5
Key Conclusions .................................................................................................. 5
Platform Overview ............................................................................................... 6
Kernel Security Boundary ..................................................................................... 6
Instrumentation & Analysis ................................................................................... 9
Findings Summary ............................................................................................. 17
Findings and Recommendations .............................................................................. 19
Findings Summary ............................................................................................. 19
Findings Detail .................................................................................................. 19
Vats Lack Isolation ............................................................................................ 20
Exceeding LMDB Map Size Limit Causes Kernel Crash............................................... 23
Unvalidated vatstore Key Length Causes Kernel Crash ............................................. 25
Log Injection via Standard Output ........................................................................ 28
Crash When Sending to Device ............................................................................ 30
Appendix I: Assessment Methodology .................................................................... 32
Appendix II: Engagement Team Biographies .......................................................... 35
Appendix III: About Atredis Partners ..................................................................... 39
Atredis Partners ⚫ Confidential Page 2
Atredis Partners – Agoric Kernel API Assessment
Engagement Overview
Assessment Components and Objectives
Agoric Systems Operating Company (“Agoric”) recently engaged Atredis Partners (“Atredis”)
to perform a Kernel API Assessment of the Agoric platform. Objectives included validation
that the lowest level of the Agoric smart-contract platform was developed and deployed with
security best practices in mind.
Testing was performed from April 4, through April 20, 2022, by Jordan Whitehead and Loren
Browman of the Atredis Partners team, with Sara Bettes providing project management and
delivery oversight. For Atredis Partners’ assessment methodology, please see Appendix I of
this document, and for team biographies, please see Appendix II. Specific testing components
and testing tasks are included below.
COMPONENT ENGAGEMENT TASKS
Agoric Kernel API Assessment
Assessment Targets
• Agoric Kernel API
• JavaScript-based kernel
• Provides interface that Agoric Vats use to communicate
with the kernel
• Approximately 13 syscalls and supporting functionality
• Unit test shim for Vats provides direct kernel interface
accessibility
Assessment Tasks
• Source-Assisted Penetration Testing of the Agoric Kernel API
• Analyze kernel architecture and threat model
• Validate attack surface & define test cases
• Manual and automated testing or each kernel API
operation
• Proof of Concept (PoC) generation, validation, and
documentation of findings
Reporting and Analysis
Analysis and Deliverables
• Status Reporting and Realtime Communication
• Comprehensive Engagement Deliverable
• Engagement Outbrief and Remediation Review
The ultimate goal of the assessment was to provide a clear picture of risks, vulnerabilities,
and exposures as they relate to accepted security best practices, such as those created by
the National Institute of Standards and Technology (NIST), or the Center for Internet Security
(CIS). Augmenting these, Atredis Partners also draws on its extensive experience in secure
development and in testing high-criticality applications and advanced exploitation.
Atredis Partners ⚫ Confidential Page 3
Atredis Partners – Agoric Kernel API Assessment
Engagement Tasks
Atredis Partners performed the following tasks, at a high level, for in-scope targets during the
engagement.
Runtime Analysis
For relevant software targets identified during the course of this engagement, Atredis
performed runtime analysis, using debugging and static analysis tools to analyze application
flow to aid in software security analysis. Where relevant, purpose-built tools such as fuzzers
and customized clients were utilized to aid in vulnerability identification.
Source Code Analysis
Atredis Partners reviewed the in-scope application source code, with an eye for security-
relevant software defects. To aid in vulnerability discovery, application components were
mapped out and modeled until a thorough understanding of execution flow, code paths, and
application design and architecture were obtained. To aid in this process, the assessment
team engaged key stakeholders and members of the development team, where possible, to
provide structured walkthroughs and interviews, helping the team rapidly gain an
understanding of the application’s design and development lifecycle.
Configuration and Architecture Review
Atredis performed a high-level review of available documentation and configuration data with
an eye toward the overall functional design and soundness of the implementation. A key
aspect of this component was to identify gaps in the architecture and design regarding aspects
of design that reduce overall defensibility, aimed at pointing out fundamental issues in the
application architecture that should be addressed early in the development cycle as opposed
to later when the platform is closer to a full production state.
While specific vulnerabilities may be identified during the architecture and configuration
review, the intent was less on finding individual defects and more on how the design of a
given target affects its overall defensibility. Outcomes of the architecture review helped to
inform testing objectives throughout the rest of the engagement while also helping the client
define a long-term platform maturity and security design roadmap.
Atredis Partners ⚫ Confidential Page 4
Atredis Partners – Agoric Kernel API Assessment
Executive Summary
Testing targeted the Agoric Kernel’s API with the untrusted vats, which is only a segment of
the whole Agoric system. Atredis Partners assessed the system as seen in the public agoric-
sdk repository at the commit beginning with 63d329. The Agoric team provided instructions
for properly building and testing local instances of the system. The Agoric’s swingset-runner
tool was used to quickly establish testing environments targeting the kernel.
Atredis Partners performed testing from the perspective of an attack-controlled va