[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Jan 2022 22:01:10 -0500
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Cc: Mark Kirkwood <markkirkwood@...alystcloud.nz>
Subject: Re: CVE-2021-3979 ceph: Ceph volume does not honour osd_dmcrypt_key_size
On Tue, Jan 11, 2022 at 4:18 PM Ana McTaggart <amctagga@...hat.com> wrote:
>
> The key length for encrypted devices created using ceph-volume is
> incorrect. This is due to a bug in ceph_volume/util/encryption.py, where
> upon writing a key using osd_dmcrypt_key_size it does not pass the key size
> to the format and open operations following. The default key is then
> applied in cryptsetup. All versions since Luminous are assumed affected. At
> Red Hat. we have assigned it CVE-2021-3979 and proposed a CVSS score of
> 6.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The score does not make a lot of sense (to me). It seems too high. A
256-bit XTS key means 128-bits are used for AES block cipher, and
128-bits are used for the AES-based tweak. I don't think many people
will feel AES-128 is a problem. If AES-128 is a problem nowadays, then
there's a boat load of software that's going to be hit with CVEs.
In practice the biggest problem will be ensuring data is not lost once
the bug is fixed.
I hope I'm not missing something obvious.
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
