CVE-2020-1759 ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
CVE-2020-1759 ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Hardik Vyas &lt;hvyas () redhat com&gt;

Date: Tue, 7 Apr 2020 12:04:59 +0530

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Hello,

A nonce reuse vulnerability was discovered in the secure mode of the
messenger v2 protocol, which can allow an
attacker to forge auth tags and potentially manipulate the data by
leveraging the reuse of a nonce in a session.
Messages encrypted using a reused nonce value are susceptible to serious
confidentiality and integrity attacks.

This flaw was introduced in commit fe387e02b11d ("msg/async, v2: drop
depedency on uint128_t. Clean up onwire
crypto.") and affects all the ceph versions from v14.1.1. Red Hat has
assigned CVE-2020-1759 for this issue.

Upstream Patches:

https://github.com/ceph/ceph-ci/commit/84d2e215969cde830b086d11544aeb3666614211
https://github.com/ceph/ceph-ci/commit/659ec7dc6e30fe961832f813da007f49e603a33d

Credit: Ilya Dryomov (Red Hat)

PS: The patches are currently available from ceph.git clone(ceph-ci) and
will be pushed to active releases soon.

Regards,
-- 

Hardik Vyas / Red Hat Product Security

BD48 C633 DE34 733A BBC3  3B72 8A14 AEBB D68B 9381

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2020-1759 ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions Hardik Vyas (Apr 07)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->