Re: CVE Request -- Corosync (2.0 <= X < 2.3): Remote DoS due improper HMAC initialization

["Fabio M. Di Nitto" <fdinitto () redhat com>]

On 02/01/2013 05:26 PM, Jan Lieskovsky wrote:
> Hello Kurt, Steve, vendors,
>
>   Corosync upstream has recently released 2.0.3 version correcting
> one security issue:

No, this version is not correct.

corosync >= 2.0 to < 2.3 are affected.

corosync 2.3 and higher have the fix.

Also, the DoS reason is not correct. The junk filter part is a
consequence on how libnss work and should be dropped.

Subject should be:

"CVE Request -- Corosync (2.0 <= X < 2.3): Remote DoS due improper HMAC
initialization"

> A denial of service flaw was found in the way Corosync,
> the cluster engine and application programming interfaces,
> performed processing of certain network packets, when different
> encryption keys were used. Previously the HMAC key was not initialized
> properly, which allowed certain packets to pass through to the internal
> phases of the Corosync packet validation process, possibly leading
> to corosync daemon crash.

I explained this in details and this description is not accurate.

"A remote denial of service flaw was found in the way Corosync, the
cluster engine and application programming interfaces, performed
processing of network packets. Previously the HMAC key was not
initialized properly, which allowed random targeted packets to be
processed by the internal process of corosync and possibly leading to a
daemon crash".

> The HMAC initialization has been corrected in upstream via:
> [5] https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595
>
> but there might be more changes needed (Cc-in Fabio and Jan).

2 missing:

https://github.com/corosync/corosync/commit/55dc09ea237482f827333759fd45608bc9518d64
https://github.com/corosync/corosync/commit/ebb007a16c6a8d9e6f783ed82b324cb232c64be5

Thanks
Fabio