Bug 1576057 (CVE-2018-1129)

Summary: CVE-2018-1129 ceph: cephx uses weak signatures
Product: [Other] Security Response Reporter: Siddharth Sharma <sisharma>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact: Aron Gunn <agunn>
Priority: medium    
Version: unspecifiedCC: agunn, branto, danmick, david, fedora, i, josef, kdreyer, kkeithle, ramkrsna, security-response-team, sisharma, steve, sweil, tserlin, uboppana, yehuda, yozone
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ceph 10.2.11, ceph 12.2.6, ceph 13.2.1 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network, who is able to alter the message payload, was able to bypass signature checks done by cephx protocol.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-24 09:06:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1576438, 1576439, 1576440, 1599405, 1599408, 1662077    
Bug Blocks: 1574281    

Description Siddharth Sharma 2018-05-08 16:56:30 UTC
A flaw was found in the way signature calculation is handled by cephx protocol. The signature calculation is encrypting a 29 byte struct with 16-byte block AES cipher, and then using the first 8 bytes of the result as signature. This only covers first (16 by tes) cipher block, data_crc falls on second block.There are no known exploits against this, If attacker can alter the message payload any changes in data_crc will not be noticed or checked by signature check.

Comment 5 Siddharth Sharma 2018-07-09 17:08:54 UTC
Created ceph tracking bugs for this issue:

Affects: fedora-all [bug 1599408]

Comment 6 errata-xmlrpc 2018-07-11 18:10:54 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 3.0 for Ubuntu 16.04

Via RHSA-2018:2177 https://access.redhat.com/errata/RHSA-2018:2177

Comment 7 errata-xmlrpc 2018-07-11 18:21:11 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 3 for Red Hat Enterprise Linux 7

Via RHSA-2018:2179 https://access.redhat.com/errata/RHSA-2018:2179

Comment 10 errata-xmlrpc 2018-07-26 15:36:03 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 2 for Ubuntu 16.04

Via RHSA-2018:2274 https://access.redhat.com/errata/RHSA-2018:2274

Comment 11 errata-xmlrpc 2018-07-26 18:06:27 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 2 for Red Hat Enterprise Linux 7

Via RHSA-2018:2261 https://access.redhat.com/errata/RHSA-2018:2261

Comment 13 Product Security DevOps Team 2019-07-24 09:06:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-1129