oss-security - CVE request: pacemaker DoS when pacemaker remote is in use

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKG8Do7TtAE4D4u3YrHdhh44QmgvxyP4PwA1dOwD79pVRwqU8g@mail.gmail.com>
Date: Fri, 30 Sep 2016 17:57:28 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE request: pacemaker DoS when pacemaker remote is in use

Hi all,

Last February was reported a vulnerability against pacemaker when pacemaker
remote is in use, allowing a remote, unauthenticated, attacker to launch a
DoS attack.
I have not found a CVE request for it, so here is one :

If a corosync node is connected to a pacemaker_remote node, the
connection can be trivially killed simply by connecting to the remote on its
standard TCP port (typically 3121):

2016-02-18T18:06:45.258661+00:00 d52-54-77-77-77-01 crmd[2637]:    error:
Unexpected pacemaker_remote client takeover. Disconnecting

Takeover is allowed in order to support migration of the remote primitive
from
one corosync node to another, but since this is a trivial denial of service
attack, it should only be allowed once a valid authkey is provided.

The flaw has been fixed in Pacemaker-1.1.15

=> Upstream bug :
 - Bug 5269 - DoS: valid authkey should be required for takeover of a
Pacemaker remote
http://bugs.clusterlabs.org/show_bug.cgi?id=5269

=> Upstream fix :
 - Fix: remote: cl#5269 - Notify other clients of a new connection only if
the handshake has completed (bsc#967388)
https://github.com/ClusterLabs/pacemaker/commit/5ec24a26

Thanks!

-- 
Cedric Buissart,
Product Security

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.