Allegro Ralph Hostname Allocation Race Condition Vulnerability

A race condition vulnerability has been identified in Allegro Ralph versions prior to commit bcf65b994ef29fb3fc2e10b660e6288723d5209e. The issue arises in the Hostname Allocation Handler, specifically within the AssetLastHostname.increment_hostname function in src/ralph/assets/models/assets.py. The vulnerability allows for concurrent asset creations to receive duplicate hostnames, which can lead to incorrect asset attribution or automation errors. This issue has been publicly disclosed.

Impact

Exploitation of this vulnerability can result in concurrent asset creations being assigned the same hostname, potentially causing duplicate entries in inventory systems or automation processes that rely on unique hostnames.

Reproduction

To reproduce this vulnerability, configure a hostname prefix to trigger the AssetLastHostname.increment_hostname method during asset creation. Start with an existing AssetLastHostname row and initiate two concurrent asset creation processes. The first worker will update the hostname counter, followed by the second worker, which will read the counter before the first worker's update is fully processed. This interleaving can cause both workers to receive the same hostname.

Remediation

It is recommended to serialize hostname allocations by locking the AssetLastHostname row within a transaction, using methods like select_for_update, or by implementing a single database operation that atomically increments and returns the allocated hostname. Additionally, a regression test should be created to ensure that concurrent allocations do not result in duplicate hostnames.