CVE-2021-21404

Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server strelaysrv can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.

Impact

1. syncthing can be caused to crash and exit if sent a malformed relay protocol message message with a negative length field.

2. The relay server strelaysrv can be caused to crash and exit if sent a malformed relay protocol message with a negative length field.

At no point is sensitive data exposed or liable to be altered due to this issue. Sensitive data is never exposed to relay operators. Syncthing itself would need to be lured to connect to a malicious relay server in order to exploit the issue.

Patches

Fixed in version 1.15.0.

Workarounds

1. No known workaround for strelaysrv.

2. syncthing can be configured to not use relays, or to only use specific, trusted relays. If Syncthing is used in a closed environment or with relaying disabled, i.e., it does not communicate with unknown relays, Syncthing is not vulnerable.

For more information

If you have any questions or comments about this advisory, please discuss it on the forum.

Thanks to Wojciech Paciorek for discovering and reporting this issue.

Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server strelaysrv can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.

Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server strelaysrv can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.

Crash due to malformed relay protocol message in github.com/syncthing/syncthing

This update for syncthing fixes the following issues:

Update to 1.15.0/1.15.1

• This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages (CVE-2021-21404); see GHSA-x462-89pf-6r5h. (boo#1184428)
• This release updates the CLI to use subcommands and adds the subcommands cli (previously standalone stcli utility) and decrypt (for offline verifying and decrypting encrypted folders).
• With this release we invite everyone to test the 'untrusted (encrypted) devices' feature. You should not use it yet on important production data. Thus UI controls are hidden behind a feature flag. For more information, visit: https://forum.syncthing.net/t/testing-untrusted-encrypted-devices/16470

Update to 1.14.0

• This release adds configurable device and folder defaults.
• The output format of the /rest/db/browse endpoint has changed.

update to 1.13.1:

• This release adds configuration options for min/max connections (see https://docs.syncthing.net/advanced/option-connection-limits.html) and moves the storage of pending devices/folders from the config to the database (see https://docs.syncthing.net/dev/rest.html#cluster-endpoints).
• Bugfixes
• Official builds of v1.13.0 come with the Tech Ui, which is impossible to switch back from

update to 1.12.1:

• Invalid names are allowed and 'auto accepted' in folder root path on Windows
• Sometimes indexes for some folders aren't sent after starting Syncthing
• [Untrusted] Remove Unexpected Items leaves things behind
• Wrong theme on selection
• Quic spamming address resolving
• Deleted locally changed items still shown as locally changed
• Allow specifying remote expected web UI port which would generate a href somewhere
• Ignore fsync errors when saving ignore files

Update to 1.12.0

• The 1.12.0 release

  • adds a new config REST API.

• The 1.11.0 release

  • adds the sendFullIndexOnUpgrade option to control whether all index data is resent when an upgrade is detected, equivalent to starting Syncthing with --reset-deltas. This (sendFullIndexOnUpgrade=true) used to be the behavior in previous versions, but is mainly useful as a troubleshooting step and causes high database churn. The new default is false.

• Update to 1.10.0

  • This release adds the config option announceLANAddresses to enable (the default) or disable announcing private (RFC1918) LAN IP addresses to global discovery.

• Update to 1.9.0

  • This release adds the advanced folder option caseSensitiveFS (https://docs.syncthing.net/advanced/folder-caseSensitiveFS.html) to disable the new safe handling of case insensitive filesystems.

• Fix Leap build by requiring at least Go 1.14

• Prevent the build system to download Go modules which would require an internet connection during the build

• Update to 1.8.0

  • The 1.8.0 release
    • adds the experimental copyRangeMethod config on folders, for use on filesystems with copy-on-write support. Please see https://docs.syncthing.net/advanced/folder-copyrangemethod.html for details.
    • adds TCP hole punching, used to establish high performance TCP connections in certain NAT scenarios where only relay or QUIC connections could be used previously.
    • adds a configuration to file versioning for how often to run cleanup. This defaults to once an hour, but is configurable from very frequently to never.
  • The 1.7.0 release performs a database migration to optimize for clusters with many devices.
  • The 1.6.0 release performs a database schema migration, and adds the BlockPullOrder, DisableFsync and MaxConcurrentWrites folder options to the configuration schema. The LocalChangeDetected event no longer has the action set to added for new files, instead showing modified for all local file changes.
  • The 1.5.0 release…

This update for syncthing fixes the following issues:

Update to 1.15.0/1.15.1

• This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages (CVE-2021-21404); see GHSA-x462-89pf-6r5h. (boo#1184428)
• This release updates the CLI to use subcommands and adds the subcommands cli (previously standalone stcli utility) and decrypt (for offline verifying and decrypting encrypted folders).
• With this release we invite everyone to test the 'untrusted (encrypted) devices' feature. You should not use it yet on important production data. Thus UI controls are hidden behind a feature flag. For more information, visit: https://forum.syncthing.net/t/testing-untrusted-encrypted-devices/16470

Update to 1.14.0

• This release adds configurable device and folder defaults.
• The output format of the /rest/db/browse endpoint has changed.

update to 1.13.1:

• This release adds configuration options for min/max connections (see https://docs.syncthing.net/advanced/option-connection-limits.html) and moves the storage of pending devices/folders from the config to the database (see https://docs.syncthing.net/dev/rest.html#cluster-endpoints).
• Bugfixes
• Official builds of v1.13.0 come with the Tech Ui, which is impossible to switch back from

update to 1.12.1:

• Invalid names are allowed and 'auto accepted' in folder root path on Windows
• Sometimes indexes for some folders aren't sent after starting Syncthing
• [Untrusted] Remove Unexpected Items leaves things behind
• Wrong theme on selection
• Quic spamming address resolving
• Deleted locally changed items still shown as locally changed
• Allow specifying remote expected web UI port which would generate a href somewhere
• Ignore fsync errors when saving ignore files

Update to 1.12.0

• The 1.12.0 release

  • adds a new config REST API.

• The 1.11.0 release

  • adds the sendFullIndexOnUpgrade option to control whether all index data is resent when an upgrade is detected, equivalent to starting Syncthing with --reset-deltas. This (sendFullIndexOnUpgrade=true) used to be the behavior in previous versions, but is mainly useful as a troubleshooting step and causes high database churn. The new default is false.

• Update to 1.10.0

  • This release adds the config option announceLANAddresses to enable (the default) or disable announcing private (RFC1918) LAN IP addresses to global discovery.

• Update to 1.9.0

  • This release adds the advanced folder option caseSensitiveFS (https://docs.syncthing.net/advanced/folder-caseSensitiveFS.html) to disable the new safe handling of case insensitive filesystems.

• Fix Leap build by requiring at least Go 1.14

• Prevent the build system to download Go modules which would require an internet connection during the build

• Update to 1.8.0

  • The 1.8.0 release
    • adds the experimental copyRangeMethod config on folders, for use on filesystems with copy-on-write support. Please see https://docs.syncthing.net/advanced/folder-copyrangemethod.html for details.
    • adds TCP hole punching, used to establish high performance TCP connections in certain NAT scenarios where only relay or QUIC connections could be used previously.
    • adds a configuration to file versioning for how often to run cleanup. This defaults to once an hour, but is configurable from very frequently to never.
  • The 1.7.0 release performs a database migration to optimize for clusters with many devices.
  • The 1.6.0 release performs a database schema migration, and adds the BlockPullOrder, DisableFsync and MaxConcurrentWrites folder options to the configuration schema. The LocalChangeDetected event no longer has the action set to added for new files, instead showing modified for all local file changes.
  • The 1.5.0 release…

These are all security issues fixed in the syncthing-1.18.2-2.1 package on the GA media of openSUSE Tumbleweed.