From bc24789f355b5e3256620865ec579092f88b56f5 Mon Sep 17 00:00:00 2001 From: Herbert Wolverson Date: Fri, 15 May 2026 10:22:31 -0500 Subject: [PATCH] Fix rand security audit finding (cherry picked from commit a38d66152b5024dd00db47dc2bd9d5a124794b20) --- SECURITY_AUDIT_2026_05_15.md | 45 ++++++++++++++++++++-------------- src/rust/Cargo.lock | 12 ++++----- src/rust/lqos_probe/Cargo.toml | 2 +- src/rust/lqosd/Cargo.toml | 2 +- 4 files changed, 35 insertions(+), 26 deletions(-) diff --git a/SECURITY_AUDIT_2026_05_15.md b/SECURITY_AUDIT_2026_05_15.md index 7382c755..09007a69 100644 --- a/SECURITY_AUDIT_2026_05_15.md +++ b/SECURITY_AUDIT_2026_05_15.md @@ -17,8 +17,9 @@ checkout. the current release state includes multiple actionable control-plane and WebUI issues that should be fixed or explicitly risk-accepted before release. - No CVE-class Rust dependency vulnerability was confirmed as reachable during - the dependency audit. A `rand` soundness advisory remains reachability unknown, - and one likely unused dependency should be removed. + the dependency audit. The `rand` soundness advisory has been remediated by + updating the locked 0.8 dependency line to `rand 0.8.6`, and one likely unused + dependency should be removed. - The Caddy/TLS path is generally well-directed for the WebUI, but the sibling API service can still bind directly on all interfaces, malformed bearer headers can panic API authentication, WebUI/local API CORS is too broad, and WebUI @@ -51,14 +52,22 @@ Commands run: - `cargo audit` - `cargo machete` - `cargo tree --locked --workspace --depth 1` +- `cargo update -p rand@0.8.5 --precise 0.8.6` +- `cargo tree --locked -p lqosd -e features` +- `cargo check -p lqos_probe -p lqosd` ### Summary - `cargo audit` scanned 549 locked crate dependencies. - No CVE-class vulnerability was reported. -- One `rand` soundness advisory is present in the locked graph. Current repo - usage touches affected APIs, but the full advisory trigger path was not found. - Reachability is recorded as unknown rather than confirmed. +- The previous `rand` soundness advisory no longer appears in `cargo audit` + after updating `rand 0.8.5` to `rand 0.8.6`. +- Direct `rand` imports now disable default features and re-enable only `std` + and `std_rng`, which are required for the current `thread_rng` and `random` + calls. The resolved graph still enables `rand/default` through upstream + `tungstenite` and `cookie` dependencies, so feature minimization is limited + to LibreQoS' direct imports unless those upstream crates are patched or + upgraded. - `cargo machete` found one likely unused dependency: `tokio` in `lqos_network_devices`. - The remaining `cargo audit` warnings were maintenance-only notices and are @@ -66,20 +75,22 @@ Commands run: ### Dependency findings and triage notes -#### Reachability unknown: RUSTSEC-2026-0097 / GHSA-cq8v-f236-94qc `rand` soundness advisory +#### Resolved: RUSTSEC-2026-0097 / GHSA-cq8v-f236-94qc `rand` soundness advisory Paths importing or using the affected dependency/API: -- `src/rust/lqosd/Cargo.toml` imports `rand = "0.8.5"`. +- `src/rust/lqosd/Cargo.toml` imports + `rand = { version = "0.8.6", default-features = false, features = ["std", "std_rng"] }`. - `src/rust/lqosd/src/node_manager/auth.rs` uses `rand::thread_rng().fill_bytes(...)` for session-key generation. - `src/rust/lqosd/src/node_manager/ws/single_user_channels.rs` uses `rand::random::()` for chatbot request IDs. -- `src/rust/lqos_probe/Cargo.toml` imports `rand = "0.8.5"`. +- `src/rust/lqos_probe/Cargo.toml` imports + `rand = { version = "0.8.6", default-features = false, features = ["std", "std_rng"] }`. - `src/rust/lqos_probe/src/lib.rs` uses `rand::random` for ICMP ping IDs. - `src/rust/lqosd/Cargo.toml` also imports `tungstenite`, `tokio-tungstenite`, and `axum-extra`, which appear in the `cargo audit` - dependency tree above `rand 0.8.5`. + dependency tree above `rand 0.8.6`. Short description: @@ -90,16 +101,14 @@ reseeding while called from the logger. LibreQoS has affected API calls, but the audit did not find a custom `log::Log` implementation or `log::set_logger` path in `src/rust/`, so the full trigger path was not found. -Recommended actions: +Remediation: -- Update direct `rand` usage to a patched release line, or replace the direct - session-key generation path with an OS RNG API such as `rand_core::OsRng` / - `getrandom`. -- After updating, run `cargo update -p rand --precise 0.8.6` if staying on - the `0.8` line, then `cargo audit` and focused checks for `lqosd` and - `lqos_probe`. -- Keep this as a release-tracked follow-up, but do not block release solely on - the advisory unless a custom logger path is introduced or discovered. +- Updated the locked 0.8 line with + `cargo update -p rand@0.8.5 --precise 0.8.6`. +- Minimized LibreQoS' direct `rand` feature requests to `std` and `std_rng`. +- Re-ran `cargo audit`; the `rand` advisory is no longer reported. +- Re-ran `cargo check -p lqos_probe -p lqosd`; both crates compile with the + updated dependency. #### Unused dependency: `tokio` in `lqos_network_devices` diff --git a/src/rust/Cargo.lock b/src/rust/Cargo.lock index e669ade8..68d033f9 100644 --- a/src/rust/Cargo.lock +++ b/src/rust/Cargo.lock @@ -678,7 +678,7 @@ dependencies = [ "aes-gcm", "base64", "percent-encoding", - "rand 0.8.5", + "rand 0.8.6", "subtle", "time", "version_check", @@ -2345,7 +2345,7 @@ version = "0.1.0" dependencies = [ "allocative", "lqos_config", - "rand 0.8.5", + "rand 0.8.6", "serde", "surge-ping", "thiserror 1.0.69", @@ -2579,7 +2579,7 @@ dependencies = [ "once_cell", "parking_lot", "png", - "rand 0.8.5", + "rand 0.8.6", "reqwest", "serde", "serde_cbor", @@ -3366,9 +3366,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.8.5" +version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" +checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" dependencies = [ "libc", "rand_chacha 0.3.1", @@ -4641,7 +4641,7 @@ dependencies = [ "httparse", "log", "native-tls", - "rand 0.8.5", + "rand 0.8.6", "sha1", "thiserror 1.0.69", "utf-8", diff --git a/src/rust/lqos_probe/Cargo.toml b/src/rust/lqos_probe/Cargo.toml index 3903c0f4..db0509b5 100644 --- a/src/rust/lqos_probe/Cargo.toml +++ b/src/rust/lqos_probe/Cargo.toml @@ -11,5 +11,5 @@ thiserror = { workspace = true } tokio = { workspace = true } tracing = { workspace = true } lqos_config = { path = "../lqos_config" } -rand = "0.8.5" +rand = { version = "0.8.6", default-features = false, features = ["std", "std_rng"] } surge-ping = "0.8.1" diff --git a/src/rust/lqosd/Cargo.toml b/src/rust/lqosd/Cargo.toml index 4f894e5b..e283526b 100644 --- a/src/rust/lqosd/Cargo.toml +++ b/src/rust/lqosd/Cargo.toml @@ -51,7 +51,7 @@ axum-extra = { version = "0.9.4", features = ["cookie", "cookie-private"] } tower-http = { version = "0.6.1", features = ["fs", "cors"] } strum = { version = "0.26.3", features = ["derive"] } default-net = { workspace = true } -rand = "0.8.5" +rand = { version = "0.8.6", default-features = false, features = ["std", "std_rng"] } serde_cbor = { workspace = true } timerfd = { workspace = true } crossbeam-channel = { workspace = true }