|
 |
827db5 |
From 6b9d4380df9bd0be91f49aad8c4f47b4e672adde Mon Sep 17 00:00:00 2001
|
|
|
827db5 |
From: Eric Blake <eblake@redhat.com>
|
|
|
827db5 |
Date: Mon, 16 Aug 2021 13:43:29 -0500
|
|
|
827db5 |
Subject: [PATCH] server: CVE-2021-3716 reset structured replies on starttls
|
|
|
827db5 |
|
|
|
827db5 |
https://nostarttls.secvuln.info/ pointed out a series of CVEs in
|
|
|
827db5 |
common implementation flaw in various SMTP and IMAP clients and
|
|
|
827db5 |
servers, all with a common thread of improperly caching plaintext
|
|
|
827db5 |
state across the STARTTLS encryption boundary; and recommended that
|
|
|
827db5 |
other protocols with a STARTTLS operation perform a similar audit.
|
|
|
827db5 |
|
|
|
827db5 |
It turns out that nbdkit has the same vulnerability in regards to the
|
|
|
827db5 |
NBD protocol: when nbdkit is run in opportunistic TLS mode, an
|
|
|
827db5 |
attacker is able to inject a plaintext NBD_OPT_STRUCTURED_REPLY before
|
|
|
827db5 |
proxying everything else a client sends to the server; if the server
|
|
|
827db5 |
then acts on that plaintext request (as nbdkit did before this patch),
|
|
|
827db5 |
then the server ends up sending structured replies to at least
|
|
|
827db5 |
NBD_CMD_READ, even though the client was assuming that the transition
|
|
|
827db5 |
to TLS has ruled out a MitM attack.
|
|
|
827db5 |
|
|
|
827db5 |
On the bright side, nbdkit's behavior on a second
|
|
|
827db5 |
NBD_OPT_STRUCTURED_REPLY was to still reply with success, so a client
|
|
|
827db5 |
that always requests structured replies after starting TLS sees no
|
|
|
827db5 |
difference in behavior (that is, qemu 2.12 and later are immune) (had
|
|
|
827db5 |
nbdkit given an error to the second request, that may have caused
|
|
|
827db5 |
confusion to more clients). And there is always the mitigation of
|
|
|
827db5 |
using --tls=require, which lets nbdkit reject the MitM message
|
|
|
827db5 |
pre-encryption. However, nbd-client 3.15 to the present do not
|
|
|
827db5 |
understand structured replies, and I have confirmed that a MitM
|
|
|
827db5 |
attacker can thus cause a denial-of-service attack that does not
|
|
|
827db5 |
trigger until the client does its first encrypted NBD_CMD_READ.
|
|
|
827db5 |
|
|
|
827db5 |
The NBD spec has been recently tightened to declare the nbdkit
|
|
|
827db5 |
behavior to be a security hole:
|
|
|
827db5 |
https://github.com/NetworkBlockDevice/nbd/commit/77e55378096aa
|
|
|
827db5 |
Fixes: eaa4c6e9a2c4bd (server: Minimal implementation of NBD Structured Replies.)
|
|
|
827db5 |
|
|
|
827db5 |
(cherry picked from commit 09a13dafb7bb3a38ab52eb5501cba786365ba7fd)
|
|
|
827db5 |
(cherry picked from commit 6185b15a81e6915734d678f0781e31d45a7941a1)
|
|
|
827db5 |
---
|
|
|
827db5 |
docs/nbdkit-security.pod | 11 +++++++++--
|
|
|
827db5 |
server/protocol-handshake-newstyle.c | 3 ++-
|
|
|
827db5 |
2 files changed, 11 insertions(+), 3 deletions(-)
|
|
|
827db5 |
|
|
|
827db5 |
diff --git a/docs/nbdkit-security.pod b/docs/nbdkit-security.pod
|
|
|
827db5 |
index 3a28e54d..5a4e6da8 100644
|
|
|
827db5 |
--- a/docs/nbdkit-security.pod
|
|
|
827db5 |
+++ b/docs/nbdkit-security.pod
|
|
|
827db5 |
@@ -10,7 +10,7 @@ For how to report new security issues, see the C<SECURITY> file in the
|
|
|
827db5 |
top level source directory, also available online here:
|
|
|
827db5 |
L<https://github.com/libguestfs/nbdkit/blob/master/SECURITY>
|
|
|
827db5 |
|
|
|
827db5 |
-=head2 CVE-2019-14850
|
|
|
827db5 |
+=head2 CVE-2019-14850
|
|
|
827db5 |
denial of service due to premature opening of back-end connection
|
|
|
827db5 |
|
|
|
827db5 |
See the full announcement and links to mitigation, tests and fixes
|
|
|
827db5 |
@@ -26,6 +26,13 @@ See the full announcement and links to mitigation, tests and fixes
|
|
|
827db5 |
here:
|
|
|
827db5 |
https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html
|
|
|
827db5 |
|
|
|
827db5 |
+=head2 CVE-2021-3716
|
|
|
827db5 |
+structured read denial of service attack against starttls
|
|
|
827db5 |
+
|
|
|
827db5 |
+See the full announcement and links to mitigation, tests and fixes
|
|
|
827db5 |
+here:
|
|
|
827db5 |
+https://www.redhat.com/archives/libguestfs/2021-August/msg00083.html
|
|
|
827db5 |
+
|
|
|
827db5 |
=head1 SEE ALSO
|
|
|
827db5 |
|
|
|
827db5 |
L<nbdkit(1)>.
|
|
|
827db5 |
@@ -38,4 +45,4 @@ Richard W.M. Jones
|
|
|
827db5 |
|
|
|
827db5 |
=head1 COPYRIGHT
|
|
|
827db5 |
|
|
|
827db5 |
-Copyright (C) 2013-2020 Red Hat Inc.
|
|
|
827db5 |
+Copyright (C) 2013-2021 Red Hat Inc.
|
|
|
827db5 |
diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c
|
|
|
827db5 |
index 0a76a814..b94950e2 100644
|
|
|
827db5 |
--- a/server/protocol-handshake-newstyle.c
|
|
|
827db5 |
+++ b/server/protocol-handshake-newstyle.c
|
|
|
827db5 |
@@ -495,7 +495,8 @@ negotiate_handshake_newstyle_options (void)
|
|
|
827db5 |
return -1;
|
|
|
827db5 |
conn->using_tls = true;
|
|
|
827db5 |
debug ("using TLS on this connection");
|
|
|
827db5 |
- /* Wipe out any cached default export name. */
|
|
|
827db5 |
+ /* Wipe out any cached state. */
|
|
|
827db5 |
+ conn->structured_replies = false;
|
|
|
827db5 |
for_each_backend (b) {
|
|
|
827db5 |
struct handle *h = get_handle (conn, b->i);
|
|
|
827db5 |
free (h->default_exportname);
|
|
|
827db5 |
--
|
|
|
fcc3c9 |
2.31.1
|
|
|
827db5 |
|