Impact

The instance of Chromium included within the OpenSearch Dashboards reporting plugin contains a memory corruption issue which may allow authorized users to execute arbitrary commands. This issue does not impact the Minimal distributions of OpenSearch Dashboards.

Related CVEs

CVE-2020-6383 (https://bugs.chromium.org/p/chromium/issues/detail?id=1051017)

Patches

We have addressed this issue in OpenSearch 1.3.5 and 2.2.1. Users can protect themselves by updating their clusters to use the latest version of OpenSearch from https://opensearch.org/downloads.html

References:

• #424
• #431

Workarounds

Users who wish to address this issue without upgrading to the latest version of the plugin can either:

1. Update the headless Chromium binary in the reporting plugin by replacing it with the latest version
   1.1) Download the latest headless Chromium binary from https://www.chromium.org/getting-involved/download-chromium
   1.2) Replace the content of opensearch-dashboards/plugins/reportsDashboards/.chromium directory with extracted chromium
   1.3) Rename chromium executable binary to headless_shell
   1.4) Make sure opensearch-dashboards/plugins/reportsDashboards/.chromium/headless_shell exists and is executable.

2. Disable JIT:
   2.1) Copy the script text below into a file and name is disable_jit.sh
   2.2) Copy disable_jit.sh script to opensearch-dashboards directory
   2.3) Run cd opensearch-dashboards && ./disable_jit.sh

#!/usr/bin/env bash
set -eo pipefail
set -x

REPORTING_DIR=$(ls -d plugins/*reports*)
[ -x "$REPORTING_DIR/.chromium/headless_shell_exec" ] && echo 'Script is already applied, exiting.' && exit 0

mv "$REPORTING_DIR"/.chromium/headless_shell "$REPORTING_DIR"/.chromium/headless_shell_exec

tee "$REPORTING_DIR"/.chromium/headless_shell >/dev/null << 'EOF'
#!/usr/bin/env bash
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" &> /dev/null && pwd 2> /dev/null)"
exec "$SCRIPT_DIR"/headless_shell_exec --js-flags="--jitless --no-opt" --disable-features=V8OptimizeJavascript "$@"
EOF

chmod +x "$REPORTING_DIR"/.chromium/headless_shell
echo "Patching finished, exiting."

References

• CVE-2020-6383

For more information

If you have any questions or comments about this advisory, please email us at [email protected]