CVE-2020-15106

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Vulnerability type

Data Validation

Detail

In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

References

Find out more on this vulnerability in the security audit report

For more information

If you have any questions or comments about this advisory:

• Contact the etcd security committee

Vulnerability type

Data Validation

Detail

The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Specific Go Packages Affected

github.com/etcd-io/etcd/wal

References

Find out more on this vulnerability in the security audit report

For more information

If you have any questions or comments about this advisory:

• Contact the etcd security committee

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

Malformed WALs can be constructed such that WAL.ReadAll can cause attempted out of bounds reads, or creation of arbitrarily sized slices, which may be used as a DoS vector.

These are all security issues fixed in the etcd-3.4.16-3.1 package on the GA media of openSUSE Tumbleweed.

This update for etcd fixes the following issues:

Update to version 3.5.12:

• Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795
• test: fix TestHashKVWhenCompacting: ensure all goroutine finished
• print error log when creating peer listener failed
• mvcc: Printing etcd backend database related metrics inside scheduleCompaction function
• dependency: update go version to 1.20.13
• commit bbolt transaction if there is any pending deleting operations
• add tests to test tx delete consistency.
• Don't flock snapshot files
• Backport adding digest for etcd base image.
• Add a unit tests and missing flags in etcd help.
• Add missing flag in etcd help.
• Backport testutils.ExecuteUntil to 3.5 branch
• member replace e2e test
• Check if be is nil to avoid panic when be is overriden with nil by recoverSnapshotBackend on line 517
• Don't redeclare err and snapshot variable, fixing validation of consistent index and closing database on defer
• test: enable gofail in release e2e test.
• [3.5] backport health check e2e tests.
• tests: Extract e2e cluster setup to separate package

• Update to version 3.5.11:

  • etcdserver: add linearizable_read check to readyz.
  • etcd: Update go version to 1.20.12
  • server: disable redirects in peer communication
  • etcdserver: add metric counters for livez/readyz health checks.
  • etcdserver: add livez and ready http endpoints for etcd.
  • http health check bug fixes
  • server: Split metrics and health code
  • server: Cover V3 health with tests
  • server: Refactor health checks
  • server: Run health check tests in subtests
  • server: Rename test case expect fields
  • server: Use named struct initialization in healthcheck test
  • Backport server: Don't follow redirects when checking peer urls.
  • Backport embed: Add tracing integration test.
  • Backport server: Have tracingExporter own resources it initialises.
  • Backport server: Add sampling rate to distributed tracing.
  • upgrade github.com/stretchr/testify,google.golang.org/genproto/googleapis/api,google.golang.org/grpc to make it consistent
  • CVE-2023-47108: Backport go.opentelemetry.io/[email protected] and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected]
  • github workflow: run arm64 tests on every push
  • etcd: upgrade go version from 1.20.10 to 1.20.11
  • bump bbolt to 1.3.8 for etcd 3.5
  • 3.5: upgrade gRPC-go to 1.58.3
  • Backport corrupt check test fix 'etcd server shouldn't wait for the ready notification infinitely on startup'
  • etcdserver: add cluster id check for hashKVHandler
  • [release-3.5]: upgrade gRPC-go to v1.52.0
  • backport #14125 to release-3.5: Update to grpc-1.47 (and fix the connection-string format)
  • Return to default write scheduler since golang.org/x/[email protected] started using round robin
  • Bump go to v1.20.10 Part of https://github.com/etcd-io/etcd/issues/16740
  • bump golang.org/x/net to 0.17.0 Part of https://github.com/etcd-io/etcd/issues/16740
  • etcd: upgrade go version to 1.20.9
  • Remove obsolete http 1.0 version.
  • fix:Ensure that go version is only defined in one file for release-3.5
  • Fix panic in etcd validate secure endpoints
  • dependency: bump golang to 1.20.8
  • Backport redirect metrics data into file to reduce output.
  • test.sh: increase timeout for grpcproxy test
  • test: add v3 curl test to cover maintenance hash/hashkv REST API
  • api: fix duplicate gateway url issue
  • pkg: add a verification on the pagebytes which must be > 0
  • tests: Backport deflake for TestWatchDelay
  • tests: Backport deflake for TestPageWriterRandom
  • Backport adding unit test for socket options.
  • Backport export reuse-port and reuse-address
  • Fix goword failure in rafthttp/transport.go.
  • Backport update to golang 1.20 minor release.
  • bump go version to 1.19.12
  • Update workflows to use makefile recipes for unit, integration & e2e-release.
  • Backport Makefile recipes for common test…

= Required Actions

== Kubernetes & etcd (Security fixes)

This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_updating_kubernetes_components for the upgrade procedure.

== Skuba & helm/helm3

In order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_update_management_workstation

= Known Issues

Modifying the file /etc/sysconfig/kubelet directly is not supported: documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscellaneous.html#_configuring_kubelet

Be sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2_4 for any additional known issues or behavioral changes.

This update for etcd fixes the following issues:

Update to version 3.5.12:

Security fixes:

• CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
• CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
• CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
• CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)
• CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
• CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
• CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
• CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
• CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
• CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)

Other changes:

• Added hardening to systemd service(s) (bsc#1181400)
• Fixed static /tmp file issue (bsc#1199031)
• Fixed systemd service not starting (bsc#1183703)

Full changelog:

https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

It was discovered that etcd incorrectly handled certain specially crafted WAL files. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-15106, CVE-2020-15112)

It was discovered that etcd incorrectly handled directory permissions when trying to create a directory that exists already. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-15113)

It was discovered that etcd incorrectly handled endpoint setup. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-15114)

USN-5628-1 fixed vulnerabilities in etcd. This update provides the corresponding updates for Ubuntu 18.04 ESM.

Original advisory details:

It was discovered that etcd incorrectly handled certain specially crafted WAL files. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-15106, CVE-2020-15112)

It was discovered that etcd incorrectly handled directory permissions when trying to create a directory that exists already. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-15113)

It was discovered that etcd incorrectly handled endpoint setup. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-15114)