Bug 1869134

Summary:	openvpn: Blind in/on-path attacks against VPN-tunneled connections
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	andrew, dazo, extras-orphan, huzaifas, klember, maci, pwouters, steve
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-25 05:28:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1776178

Description Huzaifa S. Sidhpurwala 2020-08-17 03:52:44 UTC

As per the reporter:

This is reporting a vulnerability that allows an in/on-path attacker between a VPN client and VPN server to infer and inject arbitrary data into VPN-tunneled connections. This vulnerability is related to CVE-2019-14899, but has a few key differences.

- The attacker does not need to be the gateway or network adjacent, as described in CVE-2019-14899.

- The packets are not being spoofed "outside" of the tunnel. In the previous attack, the packets were sent to the wireless/ethernet interface and were still being processed by the kernel despite coming from a non-VPN interface, in this attack we are not subverting the tunnel by sending packets to the incorrect interface, but sending packets to the VPN  server with the source address of the endhost (such as a web server).  Thus, for the VPN server, the spoofed packets that make it into the tunnel are identical to real packets from the endhost, and enter the VPN server from the same interface. For the VPN client, the spoofed packets are coming through the VPN tunnel from the VPN server.

- Enabling rp_filtering on the client machine does not prevent this attack, and source address validation on the scale of the Internet doesn't really exist.  Note that rp_filter on the server is irrelevant, since spoofed packets enter on the same interface as legitimate packets.

- The VPN providers and operating systems affected by this attack is expanded to include policy-based VPNs and Windows etc.

Comment 1 Huzaifa S. Sidhpurwala 2020-08-17 03:52:49 UTC

Statement:

This issue did not affect Red Hat Enterprise Linux 5, 6, 7 and 8 as openvpn package is currently not provided in any of our supported products.

Comment 2 Huzaifa S. Sidhpurwala 2020-08-17 03:53:00 UTC

External References:

https://breakpointingbad.com/2020/08/12/VPN-FAQ.html#faq