Bug 1868874 (CVE-2020-15114) - CVE-2020-15114 etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS
Summary: CVE-2020-15114 etcd: gateway can include itself as an endpoint resulting in r...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-15114
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1868875 1870189 1870506 1874766 1874872 1875653 1875654 1881177
Blocks: 1868882
TreeView+ depends on / blocked
 
Reported: 2020-08-14 06:09 UTC by Dhananjay Arunesh
Modified: 2021-07-27 22:31 UTC (History)
32 users (show)

Fixed In Version: etcd 3.4.10, etcd 3.3.23
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in etcd, where the etcd gateway is a simple TCP proxy that allows basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This issue results in a denial of service since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-03-17 19:52:00 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0916 0 None None None 2021-03-17 15:30:08 UTC
Red Hat Product Errata RHSA-2021:2438 0 None None None 2021-07-27 22:31:29 UTC

Description Dhananjay Arunesh 2020-08-14 06:09:10 UTC 
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

References:
https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224
Comment 1 Dhananjay Arunesh 2020-08-14 06:12:43 UTC 
Created etcd tracking bugs for this issue:

Affects: fedora-all [bug 1868875]
Comment 2 Przemyslaw Roguski 2020-08-17 15:17:13 UTC 
External References:

https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224
Comment 3 Sam Batschelet 2020-08-17 17:42:02 UTC 
FTR the etcd gateway is a v2 solution that is not used by OCP3 or OCP4 directly. This would limit exposure to RHEL7 consumers outside of OpenShift.
Comment 9 Riccardo Schirone 2020-08-27 15:03:18 UTC 
Upstream patch seems to be:
https://github.com/etcd-io/etcd/commit/47001f28bd8ee3d11a9d5be24ecbdc7f01b99449
Comment 15 Anten Skrabec 2020-09-09 22:35:33 UTC 
Statement:

In Red Hat OpenShift Container Platform (RHOCP) the vulnerable ectd is used in the ose-etcd-container. The etcd gateway uses version 2 API which is not used by OCP, hence the impact by this vulnerability is Low.
In Red Hat OpenStack Platform (RHOSP) does not use the etcd gateway and as well iits use is limited to within the internal API network, which is not accessible to any OpenStack tenants.
Comment 17 errata-xmlrpc 2021-03-17 15:30:00 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:0916 https://access.redhat.com/errata/RHSA-2021:0916
Comment 18 Product Security DevOps Team 2021-03-17 19:52:00 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15114
Comment 19 errata-xmlrpc 2021-07-27 22:31:30 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
Note You need to log in before you can comment on or make changes to this bug.