Disk encryption key and WireGuard key visible in /proc/PID/cmdline

Xem xét dstack/dstack-util/src/system_setup.rs, bắt đầu với setup_disk_encryption() và phần thiết lập WireGuard gọi wg set. Xác minh xem các khóa mã hóa ổ đĩa và WireGuard có xuất hiện trong /proc/*/cmdline hay không, sau đó đánh giá stdin cho cryptsetup và setconf với một cấu hình tạm thời được bảo vệ dành cho WireGuard. Được coi là hoàn tất khi không khóa nào trong hai khóa được truyền dưới dạng đối số dòng lệnh hoặc qua pipeline shell, và phần thiết lập hiện có vẫn thành công.

The setup_disk_encryption() function in dstack/dstack-util/src/system_setup.rs passes the disk encryption key via the kernel command line when calling cryptsetup, which exposes the key in /proc/cmdline to any process in the CVM.

Root Cause

The disk encryption key is passed to cryptsetup via a shell pipeline that makes it visible in /proc/PID/cmdline:

echo -n "$disk_crypt_key" | cryptsetup luksOpen ...

Similarly, the WireGuard private key is passed via wg set command arguments, which are also visible in procfs. Any process inside the CVM can read /proc/*/cmdline to extract these keys during the brief window when the commands are running.

Attack Path

1. Attacker compromises any process inside the CVM
2. Attacker continuously polls /proc/*/cmdline for processes containing key material
3. During CVM boot or WireGuard setup, attacker captures the disk encryption key or WireGuard private key
4. With the disk encryption key, attacker can decrypt the persistent storage offline
5. With the WireGuard key, attacker can decrypt or inject network traffic

Impact

Cryptographic key material is transiently exposed to all processes via procfs. While the window is brief (duration of the cryptsetup/wg commands), a persistent attacker polling procfs can reliably capture the keys.

Suggested Fix

Pass keys via stdin instead of command line arguments or shell pipelines, so no key material appears in /proc/PID/cmdline:

use std::io::Write;
use std::process::{Command, Stdio};

// For cryptsetup: read key from stdin using --key-file=-
let mut child = Command::new("cryptsetup")
    .args(["luksOpen", "--key-file", "-", "/dev/vda", "cryptroot"])
    .stdin(Stdio::piped())
    .spawn()?;

if let Some(mut stdin) = child.stdin.take() {
    stdin.write_all(disk_crypt_key.as_bytes())?;
}

let status = child.wait()?;

For WireGuard, use wg setconf with a configuration file (on tmpfs with 0o600 permissions) instead of passing the key on the command line.

Note: This issue was created automatically. The vulnerability report was generated by Claude and has not been verified by a human.