packages/scsi-target-utils
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!32 [sync] PR-29: Fix CVE-2024-45751

Browse Source 
From: @openeuler-sync-bot 
Reviewed-by: @wang--ge 
Signed-off-by: @wang--ge
This commit is contained in:
openeuler-ci-bot 2024-09-10 01:16:31 +00:00 committed by Gitee
commit a70ab2a422
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 69 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
backport-CVE-2024-45751.patch Normal file
View File

@ -0,0 +1,64 @@
From abd8e0d987ab56013d360077202bf2aca20a42dd Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Tue, 3 Sep 2024 16:14:58 +0200
Subject: [PATCH] chap: Use proper entropy source
The challenge sent to the initiator is based on a poor
source of randomness, it uses rand() without seeding it by srand().
So the glibc PRNG is always seeded with 1 and as a consequence the
sequence of challenges is always the same.
An attacker which is able to monitor network traffic can apply a replay
attack to bypass the CHAP authentication. All the attacker has to do
is waiting for the server or the service to restart and replay with a
previously record CHAP session which fits into the sequence.
To overcome the issue, use getrandom() to query the kernel random
number generator.
Also always send a challenge of length CHAP_CHALLENGE_MAX, there is no
benefit in sending a variable length challenge.
Signed-off-by: Richard Weinberger <richard@nod.at>
---
usr/iscsi/chap.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/usr/iscsi/chap.c b/usr/iscsi/chap.c
index aa0fc671..b89ecabd 100644
--- a/usr/iscsi/chap.c
+++ b/usr/iscsi/chap.c
@@ -28,6 +28,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <sys/random.h>
#include "iscsid.h"
#include "tgtd.h"
@@ -359,22 +360,19 @@ static int chap_initiator_auth_create_challenge(struct iscsi_connection *conn)
sprintf(text, "%u", (unsigned char)conn->auth.chap.id);
text_key_add(conn, "CHAP_I", text);
- /*
- * FIXME: does a random challenge length provide any benefits security-
- * wise, or should we rather always use the max. allowed length of
- * 1024 for the (unencoded) challenge?
- */
- conn->auth.chap.challenge_size = (rand() % (CHAP_CHALLENGE_MAX / 2)) + CHAP_CHALLENGE_MAX / 2;
+ conn->auth.chap.challenge_size = CHAP_CHALLENGE_MAX;
conn->auth.chap.challenge = malloc(conn->auth.chap.challenge_size);
if (!conn->auth.chap.challenge)
return CHAP_TARGET_ERROR;
+ if (getrandom(conn->auth.chap.challenge, conn->auth.chap.challenge_size, 0) != conn->auth.chap.challenge_size)
+ return CHAP_TARGET_ERROR;
+
p = text;
strcpy(p, "0x");
p += 2;
for (i = 0; i < conn->auth.chap.challenge_size; i++) {
- conn->auth.chap.challenge[i] = rand();
sprintf(p, "%.2hhx", conn->auth.chap.challenge[i]);
p += 2;
}

6
scsi-target-utils.spec
View File

@ -6,7 +6,7 @@
Summary: The SCSI target daemon and utility programs
Name: scsi-target-utils
Version: 1.0.91
Release: 1
Release: 2
License: GPLv2
URL: http://stgt.sourceforge.net/
Source0: https://github.com/fujita/tgt/archive/v%{version}/tgt-v%{version}.tar.gz
@ -18,6 +18,7 @@ Source5: tgtd.conf
Patch1: 0002-remove-check-for-xsltproc.patch
Patch2: 0003-default-config.patch
Patch3: tgt-1.0.79-Adapt-to-glusterfs-api-7.6.3.patch
Patch4: backport-CVE-2024-45751.patch
BuildRequires: docbook-style-xsl gcc libaio-devel libxslt perl-generators pkgconfig systemd-devel systemd-units
BuildRequires: libgfapi0
@ -124,6 +125,9 @@ echo "%{_sbindir}/tgtd" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf
%{_mandir}/man8/*
%changelog
* Mon Sep 09 2024 yaoxin <yao_xin001@hoperun.com> - 1.0.91-2
- Fix CVE-2024-45751
* Mon Mar 04 2024 xu_ping <707078654@qq.com> - 1.0.91-1
- Update to 1.0.91