Bug 1868883 (CVE-2020-15106) - CVE-2020-15106 etcd: Large slice causes panic in decodeRecord method
Summary: CVE-2020-15106 etcd: Large slice causes panic in decodeRecord method
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-15106
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1869286 1868884 1870189 1870509 1874769 1874872 1875653 1875654 1881175
Blocks: 1868882
TreeView+ depends on / blocked
 
Reported: 2020-08-14 06:39 UTC by Dhananjay Arunesh
Modified: 2021-07-27 22:31 UTC (History)
34 users (show)

Fixed In Version: etcd 3.4.10, etcd 3.3.23
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found In etcd, where a large slice causes panic in the decodeRecord method. The size of a record is stored in the length field of a WAL file, and no additional validation is performed on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-03-17 19:52:19 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0916 0 None None None 2021-03-17 15:30:36 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 22:31:31 UTC

Description Dhananjay Arunesh 2020-08-14 06:39:12 UTC 
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

References:
https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
Comment 1 Dhananjay Arunesh 2020-08-14 06:39:48 UTC 
Created etcd tracking bugs for this issue:

Affects: fedora-all [bug 1868884]
Comment 3 Przemyslaw Roguski 2020-08-17 15:00:44 UTC 
Upstream fix: https://github.com/etcd-io/etcd/commit/4571e528f49625d3de3170f219a45c3b3d38c675
Comment 4 Przemyslaw Roguski 2020-08-17 15:02:50 UTC 
External References:

https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
Comment 16 Summer Long 2020-09-07 05:14:37 UTC 
Statement:

* In Red Hat OpenShift Container Platform (RHOCP), the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only.
* In Red Hat OpenStack Platform (RHOSP), the use of etcd is limited to the internal API network, which is not accessible to OpenStack tenants.

The security impact for these products is therefore rated as Low.
Comment 21 errata-xmlrpc 2021-03-17 15:30:23 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916
Comment 22 Product Security DevOps Team 2021-03-17 19:52:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15106
Comment 23 errata-xmlrpc 2021-04-27 16:20:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2021:1407 https://access.redhat.com/errata/RHSA-2021:1407
Comment 24 errata-xmlrpc 2021-07-27 22:31:29 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
Note You need to log in before you can comment on or make changes to this bug.