Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1883988 (CVE-2020-25645) - CVE-2020-25645 kernel: Geneve/IPsec traffic may be unencrypted between two Geneve endpoints
Summary: CVE-2020-25645 kernel: Geneve/IPsec traffic may be unencrypted between two Ge...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-25645
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1885994 1884481 1885144 1885145 1885146 1885147 1885148 1886425
Blocks: 1879667
TreeView+ depends on / blocked
 
Reported: 2020-09-30 16:51 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-03-16 19:18 UTC (History)
50 users (show)

Fixed In Version: Linux kernel 5.9-rc7
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.
Clone Of:
Environment:
Last Closed: 2021-03-16 19:18:58 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0856 0 None None None 2021-03-16 13:51:03 UTC
Red Hat Product Errata RHSA-2021:0857 0 None None None 2021-03-16 13:51:58 UTC

Description Guilherme de Almeida Suckevicz 2020-09-30 16:51:25 UTC
A flaw was found in the Linux kernel's implementation of GENEVE tunnels combined with IPsec. The traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

Reference and upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=34beb21594519ce64a55a498c2fe7d567bc1ca20

Comment 8 Alex 2020-10-06 10:58:01 UTC
Mitigation:

A possible workaround for this flaw is to configure IPsec for all traffic between the endpoints, instead of specifically for the UDP port used by the GENEVE tunnels. If GENEVE tunnels are not used, this flaw will not be triggered. In that case, it is possible to disable those tunnels, by unloading the "geneve" kernel module and blacklisting it (See https://access.redhat.com/solutions/41278 for a
guide on how to blacklist modules).

Comment 9 Alex 2020-10-06 11:01:38 UTC
More detailed description (and keeping comment 0 short description too):

A flaw was found in the Linux kernel's implementation of GENEVE tunnels combined with IPsec. When IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel, the kernel isn't correctly routing tunneled data over the encrypted link, and sending the data unencrypted instead. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

Comment 12 Petr Matousek 2020-10-08 12:29:17 UTC
Acknowledgments:

Name: Mark Gray (Red Hat), Sabrina Dubroca (Red Hat)

Comment 13 Petr Matousek 2020-10-08 12:29:58 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1886425]

Comment 14 Justin M. Forbes 2020-10-08 18:46:04 UTC
This was resolved for Fedora with the 5.8.12 stable kernel updates.

Comment 18 errata-xmlrpc 2021-03-16 13:50:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0856 https://access.redhat.com/errata/RHSA-2021:0856

Comment 19 errata-xmlrpc 2021-03-16 13:51:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0857 https://access.redhat.com/errata/RHSA-2021:0857

Comment 20 Product Security DevOps Team 2021-03-16 19:18:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25645


Note You need to log in before you can comment on or make changes to this bug.