Bug 2304071 - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Summary: libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: krb5
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Julien Rische
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-08-12 08:13 UTC by Onur Türkmen
Modified: 2024-11-15 03:21 UTC (History)
12 users (show)

Fixed In Version: krb5-1.21.3-3.fc42 krb5-1.21.3-3.fc41 krb5-1.21.3-2.fc40 krb5-1.21.3-2.fc39
Clone Of:
Environment:
Last Closed: 2024-10-30 18:31:06 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Before and after microsoft update (108.73 KB, image/png)
2024-08-12 08:13 UTC, Onur Türkmen
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FREEIPA-11476 0 None None None 2024-08-22 08:44:06 UTC

Description Onur Türkmen 2024-08-12 08:13:49 UTC
Created attachment 2043960 [details]
Before and after microsoft update

Description of problem: After Microsoft Radius (NPS) Server 2019 KB5040430 update for CVE-2024-3596 Vulnerability, FreeIPA cannot connect successfully to RADIUS. When I listed of cat krb5kdc.log , I saw the failure log that is PREAUTHENTICATION_FAILED.
And then when I traced the traffic via wireshark on microsoft radius server 2019 I realized that radius atributes of the response for Access Request started from FreeIPA named Access Accept contains Message Authenticatior Attribute.
I believe that the FreeIPA cannot making sense this attribute or header and this may resolved with an upgrade on the FreeIPA side.


Version-Release number of selected component (if applicable): FreeIPA 4.12.1


How reproducible: Continuously


Steps to Reproduce:
1. Free IPA upgrade for this issue.


Actual results: AUTHENTICATION_FAILED


Expected results: Successfull Authentication from any FreeIPA client loaded including another linux distribution.


Additional info:

Comment 1 Alexander Bokovoy 2024-08-13 07:10:44 UTC
Can you make the actual traces available?

It looks like MSFT has published this guideline: 
https://support.microsoft.com/en-us/topic/kb5040268-how-to-manage-the-access-request-packets-attack-vulnerability-associated-with-cve-2024-3596-a0e2f0b1-f200-4a7b-844f-48d1d5ab9e66

Comment 2 Alexander Bokovoy 2024-08-13 07:16:41 UTC
In order to implement this, I think libkrad needs to be extended to provide automatic insertion of the Message-Authenticator attribute (https://www.rfc-editor.org/rfc/rfc3579#section-3.2) based on some API-passed flags. I'd leave design of that to MIT Kerberos folks.

Comment 3 Onur Türkmen 2024-08-13 12:12:09 UTC
Thanks for interest Alexander.
As I understand krb5 should be upgraded by Kerberos Folks. Am I right? By the way I missed that my Free IPA server running on FEDORA 40. So should I still wait for kerberos folks or is there anything to do by ourself.
Lastly Are you have any connection with MIT Kerberos folks to assing to this topic. Could you give a hand to us :)

Comment 4 Alexander Bokovoy 2024-08-13 12:27:09 UTC
It is something that has to be implemented first, that's why I moved this bug to krb5 package. Its maintainer will have to work on it.

There is no plan yet when this work would be done, so don't expect any fix any time soon.

Comment 5 Alexander Bokovoy 2024-08-13 12:28:15 UTC
FYI, a similar issue is reproducible with default FreeRADIUS setup after the fix for CVE-2024-3596 was fixed. This should help with development of the fix on libkrad side.

Comment 6 Julien Rische 2024-10-30 11:40:09 UTC
Rawhide RPM dist-git merge request:
https://src.fedoraproject.org/rpms/krb5/pull-request/58

Comment 7 Julien Rische 2024-10-30 15:43:53 UTC
Fedora 41 RPM dist-git merge request:
https://src.fedoraproject.org/rpms/krb5/pull-request/59

Fedora 40 RPM dist-git merge request:
https://src.fedoraproject.org/rpms/krb5/pull-request/60

Fedora 39 RPM dist-git merge request:
https://src.fedoraproject.org/rpms/krb5/pull-request/61

Comment 8 Fedora Update System 2024-10-30 16:42:16 UTC
FEDORA-2024-ed15d25bf3 (krb5-1.21.3-3.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-ed15d25bf3

Comment 9 Fedora Update System 2024-10-30 16:53:56 UTC
FEDORA-2024-862f5c4156 (krb5-1.21.3-2.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-862f5c4156

Comment 10 Fedora Update System 2024-10-30 16:54:01 UTC
FEDORA-2024-29a74ac2b0 (krb5-1.21.3-2.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-29a74ac2b0

Comment 11 Fedora Update System 2024-10-30 16:54:10 UTC
FEDORA-2024-c0961d31b8 (krb5-1.21.3-3.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-c0961d31b8

Comment 12 Fedora Update System 2024-10-30 18:31:06 UTC
FEDORA-2024-ed15d25bf3 (krb5-1.21.3-3.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2024-10-31 02:33:13 UTC
FEDORA-2024-862f5c4156 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-862f5c4156`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-862f5c4156

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2024-10-31 03:08:38 UTC
FEDORA-2024-29a74ac2b0 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-29a74ac2b0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-29a74ac2b0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2024-10-31 03:41:38 UTC
FEDORA-2024-c0961d31b8 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c0961d31b8`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c0961d31b8

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 16 Onur Türkmen 2024-10-31 12:42:48 UTC
Hello team
Firstly, Thanks for intertest. I got the updates that released for this topic and ıt solved my problem. Again Thanks for All Comunity.

Comment 17 Alexander Bokovoy 2024-10-31 12:57:09 UTC
Thank you for the confirmation, Onur!

Comment 18 Fedora Update System 2024-11-02 02:24:21 UTC
FEDORA-2024-c0961d31b8 (krb5-1.21.3-3.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 19 Fedora Update System 2024-11-15 03:17:52 UTC
FEDORA-2024-29a74ac2b0 (krb5-1.21.3-2.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 20 Fedora Update System 2024-11-15 03:21:15 UTC
FEDORA-2024-862f5c4156 (krb5-1.21.3-2.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.