etcd up to 3.3.22/3.4.9 WAL File decodeRecord length input validation

Summaryinfo

A vulnerability marked as problematic has been reported in etcd up to 3.3.22/3.4.9. The impacted element is the function decodeRecord of the component WAL File Handler. This manipulation of the argument length causes input validation. This vulnerability is handled as CVE-2020-15106. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in etcd up to 3.3.22/3.4.9 and classified as problematic. Affected by this vulnerability is the function decodeRecord of the component WAL File Handler. The manipulation of the argument length with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

The weakness was released 08/05/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2020-15106 since 06/25/2020. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 208622 (CentOS 7 : etcd (RHSA-2021:1407)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.3.23 or 3.4.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208622). Entries connected to this vulnerability are available at VDB-159333 and VDB-159332. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• etcd

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7
• 3.3.8
• 3.3.9
• 3.3.10
• 3.3.11
• 3.3.12
• 3.3.13
• 3.3.14
• 3.3.15
• 3.3.16
• 3.3.17
• 3.3.18
• 3.3.19
• 3.3.20
• 3.3.21
• 3.3.22
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion