Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Ana McTaggart &lt;amctagga () redhat com&gt;

Date: Tue, 17 Nov 2020 11:30:45 -0500

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Correction. The correct CVE is CVE-2020-25660

Ana McTaggart

Red Hat Product Security

Red Hat Remote &lt;https://www.redhat.com&gt;

secalert () redhat com for urgent response

amct () redhat com

M: 7742790791     IM: amctagga

Pronouns:They/Them/Theirs

On Tue, Nov 17, 2020 at 9:10 AM Ana McTaggart &lt;amctagga () redhat com&gt; wrote:

Dear all,
cephx authentication protocol does not verify ceph clients correctly, and
is vulnerable to replay attacks in nautilus and later. An attacker with
access to the Ceph cluster network can use this vulnerability to
authenticate with ceph service, via a packet sniffer. This allows them to
perform actions allowed by the ceph service. This is a reintroduction of
CVE-2018-1128[1], affecting msgr2 protocol. msgr 2 protocol is used for all
communication except for older clients that do not support msgr2 protocol.
msgr1 protocol is not affected.

This was introduced in commit to msgr2 321548010578 ("mon/MonClient: skip
CEPHX_V2 challenge if client doesn't support it") , due to commit
c58c5754dfd2 ("msg/async/ProtocolV1: use AuthServer and AuthClient") . This
results in nautilus and ceph being affected because commit c58c5754dfd2
wasn't backported to nautilus, and although msgr1 isn't affected in
nautilus, msgr 2 is the default. This made it so authorizer challenges
could be skipped for peers which did not support CEPHX_V2, unfortunately
making it so authorizer challenges are skipped for all peers in both msgr 1
and msgr2 cases, disabling the protection that was put in place in commit
f80b848d3f83 ("auth/cephx: add authorizer challenge", CVE-2018-1128).

Proposed Patch:
See attached.

We have assigned it a CVE of CVE-2020-25677 at Red Hat.

Credits to Ilya Dryomov

[1]https://www.cvedetails.com/cve/CVE-2018-1128/

Ana McTaggart

Red Hat Product Security

Red Hat Remote &lt;https://www.redhat.com&gt;

secalert () redhat com for urgent response

amct () redhat com

M: 7742790791     IM: amctagga

Pronouns:They/Them/Theirs

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost Ana McTaggart (Nov 17)

Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lost Ana McTaggart (Nov 17)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->