Bug 1868874 (CVE-2020-15114)

Summary:	CVE-2020-15114 etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abishop, bmontgom, dbecker, eparis, go-sig, gparvin, gscrivan, hvyas, jburrell, jcajka, jchaloup, jjoyce, jokerman, jramanat, jschluet, jweiser, kbasil, lacypret, lemenkov, lhh, lpeer, mburns, nstielau, puebele, sbatsche, sclewis, slinaber, sponnaga, stcannon, strigazi, tfister, thee
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	etcd 3.4.10, etcd 3.3.23	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in etcd, where the etcd gateway is a simple TCP proxy that allows basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This issue results in a denial of service since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-17 19:52:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1868875, 1870189, 1870506, 1874766, 1874872, 1875653, 1875654, 1881177
Bug Blocks:	1868882

Description Dhananjay Arunesh 2020-08-14 06:09:10 UTC

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

References:
https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224

Comment 1 Dhananjay Arunesh 2020-08-14 06:12:43 UTC

Created etcd tracking bugs for this issue:

Affects: fedora-all [bug 1868875]

Comment 2 Przemyslaw Roguski 2020-08-17 15:17:13 UTC

External References:

https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224

Comment 3 Sam Batschelet 2020-08-17 17:42:02 UTC

FTR the etcd gateway is a v2 solution that is not used by OCP3 or OCP4 directly. This would limit exposure to RHEL7 consumers outside of OpenShift.

Comment 9 Riccardo Schirone 2020-08-27 15:03:18 UTC

Upstream patch seems to be:
https://github.com/etcd-io/etcd/commit/47001f28bd8ee3d11a9d5be24ecbdc7f01b99449

Comment 15 Anten Skrabec 2020-09-09 22:35:33 UTC

Statement:

In Red Hat OpenShift Container Platform (RHOCP) the vulnerable ectd is used in the ose-etcd-container. The etcd gateway uses version 2 API which is not used by OCP, hence the impact by this vulnerability is Low.
In Red Hat OpenStack Platform (RHOSP) does not use the etcd gateway and as well iits use is limited to within the internal API network, which is not accessible to any OpenStack tenants.

Comment 17 errata-xmlrpc 2021-03-17 15:30:00 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916

Comment 18 Product Security DevOps Team 2021-03-17 19:52:00 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15114

Comment 19 errata-xmlrpc 2021-07-27 22:31:30 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438