Bug 1424984 (CVE-2017-2624)

Summary:	CVE-2017-2624 xorg-x11-server: timing attack against MIT Cookie
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ajax, ofourdan, security-response-team, xgl-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-01 00:37:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1427559, 1910736
Bug Blocks:	1424993

Description Martin Prpič 2017-02-20 09:19:31 UTC

The following flaw was reported in the Xorg server:

Summary and Impact
------------------
xorg-server/xorg-server-1.19.0/os/mitauth.c:79 uses memcmp() to check
the received MIT cookie against a series of valid cookies. If the cookie
is correct, it is allowed to attach to the Xorg session. Since most
memcmp() implementations return after an invalid
byte is seen, this causes a time difference between a valid and invalid
byte, which in theory could allow an efficient brute force attack[1].

Analysis
--------
X41 was not able to measure a significant difference using the optimized
memcmp() version of a standard Linux system, but for a naive implementation
consisting of a loop comparing the bytes. Since timing attacks against
memcmp() have been successful in the past [2] and fixed elsewhere
[3][4] X41 would consider this an issue. If this would be exploited, it
would allow a local attacker to run code in the Xorg session of another
user.

In order to prevent this, MIT-COOKIES should be removed or a memcmp()
similar to timingsafe_memcmp()[5] used. Other projects (e.g. openssl)
use timing safe memcmp() implementations to compare cookies retrieved
via the network[6].

[1] https://cryptocoding.net/index.php/Coding_rules#Compare_secret_strings_in_constant_time
[2] http://de.slideshare.net/cisoplatform7/defcon-22paulmcmillanattackingtheiotusingtimingattac
[3] http://seb.dbzteam.org/crypto/python-oauth-timing-hmac.pdf
[4] https://bugs.ruby-lang.org/issues/10098
[5] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/string/timingsafe_memcmp.c
[6] https://github.com/openssl/openssl/blob/master/ssl/t1_lib.c#L1249

Comment 1 Martin Prpič 2017-02-20 09:19:34 UTC

Acknowledgments:

Name: Eric Sesterhenn (X41 D-Sec GmbH)

Comment 2 Doran Moppert 2017-02-27 06:29:58 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Comment 5 Andrej Nemec 2017-02-28 15:32:39 UTC

Created xorg-x11-server tracking bugs for this issue:

Affects: fedora-all [bug 1427559]

Comment 6 Andrej Nemec 2017-02-28 15:32:54 UTC

External References:

https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/