[Security] Unscoped, World-writable CPU-throttle semaphore enables local build DoS #50

Severity: CVSS 3.3 (Low) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · MSRC Moderate
Attacker: local user

Affected code

• Core/PostSharp.Platform.NetFramework/NetFrameworkSystemSemaphoreProvider.cs:29-38 and Core/PostSharp.Platform.NetCore/NetCoreAppOnWindowsSystemSemaphoreProvider.cs:32-49 — new SemaphoreAccessRule(WorldSid, FullControl, Allow)
• Core/PostSharp.Compiler.Hosting/Program.cs:414-417 — WaitOne() on the semaphore

Description

The CPU-throttle system semaphore is named with the fixed literal "PostSharp" (no user SID, no Local\/Global\ qualifier) and its ACL grants WorldSid FullControl. Any local user can OpenExisting it and drain its count (or over-Release it), blocking all PostSharp builds on the machine.

Exploit scenario

An unprivileged user opens the "PostSharp" semaphore and WaitOnes MaxParallelism times without releasing; every subsequent compiler invocation blocks at "All CPU cores are busy" indefinitely — a persistent, low-effort DoS against all builds on a shared agent.

Recommendation

Qualify the name with the current user SID (and Local\ if cross-session sharing is not intended) and tighten the ACL to the current user instead of WorldSid. If global coordination is genuinely required, restrict the ACL to a controlled group rather than Everyone.

Backward compatibility

Name change → transient window where old/new processes do not share the throttle (it is a perf optimization); note in Release Notes.

Severity notes

Most debatable: A — L (only builds blocked, immediate recovery) vs H (build capability fully denied while the attack persists → 5.5).

Part of #56.