Bug 1708775 (CVE-2020-10769)

Summary: CVE-2020-10769 kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned.
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hannsj_uhl, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, mvanderw, nmurray, plougher, ptalbert, qzhao, rkeshri, rt-maint, rvrbovsk, security-response-team, steved, williams, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-08-25 19:17:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1846104, 1846105, 1846355    
Bug Blocks: 1708776, 1869392    

Description Pedro Sampaio 2019-05-10 20:15:18 UTC 
A buffer overread problem was found in crypto_authenc_extractkeys in crypto/authenc.c in IPsec Cryptographic algorithms module authenc. When a payload longer than 4 bytes, is not following a 4-byte alignment boundary guidelines, may cause a buffer overread threat, leading to a system crash problem. An attacker locally with a user privilege can cause a denial of service (DoS).  

crypto_authenc_extractkeys() fails to consider the case where the rtattr's payload is longer than 4 bytes but not 4-byte aligned, and where the key ends before the next 4-byte aligned boundary.  In this case, 'keylen -=RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX.  This causes a buffer overread and crash during  crypto_ahash_setkey().

Proposed upstrem patch:

https://lkml.org/lkml/2019/1/21/675
Comment 4 Rohit Keshri 2020-06-10 18:48:32 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 12 errata-xmlrpc 2020-08-25 13:13:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3545 https://access.redhat.com/errata/RHSA-2020:3545
Comment 13 Product Security DevOps Team 2020-08-25 19:17:31 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10769
Comment 14 errata-xmlrpc 2020-12-15 11:11:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5437 https://access.redhat.com/errata/RHSA-2020:5437
Comment 15 errata-xmlrpc 2020-12-15 11:16:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5441 https://access.redhat.com/errata/RHSA-2020:5441