Bug 1868870 (CVE-2020-15113) - CVE-2020-15113 etcd: directories created via os.MkdirAll are not checked for permissions
Summary: CVE-2020-15113 etcd: directories created via os.MkdirAll are not checked for ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-15113
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1869240 1868871 1870189 1870504 1874764 1874872 1875653 1875654 1881173
Blocks: 1868882
TreeView+ depends on / blocked
 
Reported: 2020-08-14 06:03 UTC by Dhananjay Arunesh
Modified: 2021-07-27 22:31 UTC (History)
34 users (show)

Fixed In Version: etcd 3.4.10, etcd 3.3.23
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in etcd. Certain directory paths are created with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already.
Clone Of:
Environment:
Last Closed: 2021-03-17 19:51:47 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0916 0 None None None 2021-03-17 15:29:56 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 22:31:23 UTC

Description Dhananjay Arunesh 2020-08-14 06:03:17 UTC
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).

References:
https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92

Comment 1 Dhananjay Arunesh 2020-08-14 06:05:26 UTC
Created etcd tracking bugs for this issue:

Affects: fedora-all [bug 1868871]

Comment 2 lnacshon 2020-08-17 11:09:46 UTC
Patched versions
3.4.10, 3.3.23

Comment 4 Sam Batschelet 2020-08-17 11:58:34 UTC
Care is needs to be take to ensure that no possible senario exists where etcd will fail to start because of pervious permissions. For this reason this patch will be deffered until proper testing can be completed. The failure case of "permission was not checked on existing data directory and the directory used for automatically generating self-signed certificates for TLS connections with clients" does not apply to OCP4.

Comment 5 Przemyslaw Roguski 2020-08-17 15:08:35 UTC
External References:

https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92

Comment 19 Anten Skrabec 2020-09-04 01:46:33 UTC
Statement:

In Red Hat OpenShift Container Platform (RHOCP) the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only, therefore the impact by this vulnerability is Low.
A similar access restriction is in place in Red Hat OpenStack Platform (RHOSP) as etcd is limited to use within the internal API network, which is not accessible to any OpenStack tenants.

Comment 22 errata-xmlrpc 2021-03-17 15:29:55 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916

Comment 23 Product Security DevOps Team 2021-03-17 19:51:47 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15113

Comment 24 errata-xmlrpc 2021-07-27 22:31:21 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438


Note You need to log in before you can comment on or make changes to this bug.