Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+q1=fSNAzwjywo9qnkRyO0S7refmUZFFciMyKcKE6oNoQjRLQ@mail.gmail.com>
Date: Mon, 5 Sep 2016 16:06:10 -0700
From: Diogo Mónica <diogo.monica@...ker.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Re: cve request: docker swarmkit Dos occurs by
 repeatly joining and quitting swam cluster as a node

>
> DoS is often a gray area. Obviously if I send 10 gigabits of request
> traffic and swarm gets slow/non responsive the CVE response would be "Well
> yeah... that's probably what happens if you saturate the network with
> requests. No CVE for you" but if a single node behaves in an odd way and
> prevents the whole system from working in an expected manner, that may be a
> problem that is worth a CVE, especially if it can be triggered by an
> attacker/less trusted user (classic trust boundary violation to quote
> @sushidude).
>

Again, there is no trust boundary violation. You have a token that allows
you to join an unlimited number of workers. The system supports N workers,
you join N + 1, the system starts rejecting new workers.

No malicious attacker can ever join any workers unless they have the token,
and if you are paranoid, you can always rotate the secret token after each
worker join.


> Regardless of whether this is CVE worthy is there any plan to add rate
> limiting or other protective measures to prevent a single badly
> behaved/malicious node from making the swarm unable to operate normally? I
> don't see any issues in https://github.com/docker/swarm/issues for this.
> Thanks!
>

I don't believe this is the right thread to discuss other topics. I'm here
to get this CVE rescinded, since there is no reason for its existence in
the first place.

If you'd like to discuss any other matters related to docker or swarm, feel
free to do so by either open an issue on our GH repository, or our forums:
https://forums.docker.com.

Thank you,
Diogo Monica

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.