Security
Random numbers from CPU execution time jitter
Availability of entropy, especially for embedded devices early in the kernel boot process, is a commonly discussed problem in the kernel random number community. The usual sources of entropy depend on events like the timing of user input or disk interrupts that may not be present yet—or at all. A patch set from Stephan Müller seeks to remedy that by using entropy that is collected from a source that is always present: CPU execution time jitter.
On a modern processor, there are many different factors that can impact the amount of time it takes to execute the same set of instructions. If one measures that execution time precisely multiple times, it will show variation—jitter. An attacker who doesn't have any special hardware-level access to the CPU cannot predict this jitter, which makes it a good source of entropy, according to Müller's lengthy paper on the technique.
There are numerous CPU-level activities that lead to unpredictability in execution time. The fill level of the instruction pipelines, memory wait states, instruction and data caches, branch prediction, interrupts, power management, frequency scaling, and so on can all contribute to changing the execution time. As Müller's paper shows, a wide variety of today's processors show enough jitter (in a statistical sense) to be used as an entropy source for the kernel's random number pools.
The heart of the algorithm to implement Müller's jitter measurement
gathering lives in the jent_measure_jitter()
function. It is effectively a "random bit generator
", since
it returns a single bit that has been calculated based on the jitter
measured in that function.
The first step is to introduce some noise into the measurement based on
memory reads and writes.
The jitter entropy module allocates a 2KB buffer during initialization that
it loops through and simply adds one to the value stored there (which
causes both a load and a store). The buffer
is larger than the L1 cache of the processor, which should introduce some
unpredictable wait states into the measurement.
It then gets a timestamp and calculates a delta from the previous
timestamp.
This delta is used in a "deliberately
inefficient
" calculation to fold the value down to a single bit.
There are faster ways to do the folding operation, but his algorithm is
part of what is being measured for jitter in the execution time.
In order to preserve those measurements, optimization for the jitter random number
generator (RNG) must be turned off. In fact, there is a test in the code that will cause the build to fail if optimization is enabled to avoid the possibility of getting bad random numbers from a misconfigured build.
The comment for the
jent_fold_time() function explains a bit further:
The jent_gen_entropy() function generates a 64-bit random number by calling jent_measure_jitter() 64 times. Getting larger amounts of random data is done with jent_read_entropy(), which takes a buffer and length and repeatedly calls jent_gen_entropy() to fill the buffer with the requested amount of random data.
Adding the CPU jitter RNG is only part of what the patch set does, however. The kernel's deterministic random bit generator (DRBG) is currently initialized by making a call to get_random_bytes(), which uses the non-blocking random number pool. In certain circumstances (e.g. for some embedded devices or virtual machines), that pool will not have been seeded from enough events to provide the entropy required.
In mid-April, kernel crypto subsystem maintainer Herbert Xu asked Müller whether the current DRBG implementation was compliant with the US National Institute of Standards and Technology (NIST) SP 800-90A specification for DRBGs that specifies seeding DRBGs from non-deterministic sources. Since the worst case for get_random_bytes() is that it is completely deterministic, Xu felt that some other mechanism should be used to seed the kernel's DRBG so that it complied.
Müller had already proposed inclusion of his CPU jitter RNG in October 2013. He used that code as the basis for this new patch set. Instead of reusing the existing blocking pool (i.e. the one that feeds /dev/random), though, his patch creates a new kernel_pool that is only accessible to the kernel itself. That eliminates a kind of denial-of-service attack where a user-space program can continuously read /dev/random to consume all of the entropy being generated by the system.
The DRBG is then seeded early in the boot process from a combination of get_random_bytes() and the jitter RNG. In addition, an asynchronous call is made for the required amount of random data from the new, blocking kernel_pool. It will only return once the required amount of entropy has been gathered by the system and the random data returned will be used to reseed the DRBG. Thus, the DRBG is always seeded with non-deterministic data early on—as long as the jitter RNG is actually producing random numbers.
Back in 2013, kernel RNG maintainer Ted Ts'o expressed skepticism about the jitter technique. He was concerned that the measurements were not as unpredictable as they appear to be—that a sufficiently knowledgeable attacker could determine enough of the state to predict the timing.
Effectively, he was worried that the entropy estimation for the jitter measurements was too high, perhaps far too high.
Ts'o has not commented on the latest patches, at least yet. In fact, there haven't really been any technical comments on the patches as yet. Xu seemed to indicate that he is generally in favor of Müller's solution for the DRBG. If the patches do get merged, perhaps other users for the jitter RNG will emerge. It is a fairly straightforward and speedy mechanism for collecting entropy—the question is how much of that entropy is "real".
Brief items
Security quotes of the week
There might be functionality hidden in the code that just sits there and waits for a system with a hostname somewhat like "yourcompany.com" to start looking for its command and control server to steal some key data from your company. The way your systems are built they probably do not have much of a firewall guarding against such. Much of the software may be constantly calling home, and your DevOps would not notice (nor would they care, anyway).
The mentality of "big data stacks" these days is that of Windows Shareware in the 90s. People downloading random binaries from the Internet, not adequately checked for security (ever heard of anybody running an AntiVirus on his Hadoop cluster?) and installing them everywhere.
The second is that we should stop pretending that this capability is exclusive to law enforcement, and recognize that we're all at risk because of it. If we continue to allow our cellular networks to be vulnerable to IMSI-catchers, then we are all vulnerable to any foreign government, criminal, hacker, or hobbyist that builds one. If we instead engineer our cellular networks to be secure against this sort of attack, then we are safe against all those attackers.
There is no device or method, however powerful, which will offer a salient defense for more than a short time. The bad guys endlessly adapt; so must we. Importantly, the bad guys understand how our systems work; so must we.
Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)
Ars Technica reports on a wpa_supplicant bug that might leave Linux and other systems open to remote code execution. "That's because the code fails to check the length of incoming SSID information and writes information beyond the valid 32 octets of data to memory beyond the range it was allocated. SSID information 'is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets,' [wpa_supplicant maintainer Jouni] Malinen wrote, and the code 'was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device. This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The overflow can override a couple of variables in the struct, including a pointer that gets freed. In addition, about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation.'"
New vulnerabilities
389-ds-base: access control bypass
| Package(s): | 389-ds-base | CVE #(s): | CVE-2015-1854 | ||||||||||||||||
| Created: | April 29, 2015 | Updated: | May 4, 2015 | ||||||||||||||||
| Description: | From the Red Hat advisory:
A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server. (CVE-2015-1854) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
cherokee: authentication bypass
| Package(s): | cherokee | CVE #(s): | CVE-2014-4668 | ||||||||||||||||
| Created: | April 27, 2015 | Updated: | May 5, 2015 | ||||||||||||||||
| Description: | From the CVE entry:
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
chromium: multiple vulnerabilities
| Package(s): | chromium | CVE #(s): | CVE-2015-1243 CVE-2015-1250 | ||||||||||||||||||||||||||||
| Created: | April 29, 2015 | Updated: | May 12, 2015 | ||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2015-1243 (use-after-free): Use-after-free in DOM. Credit to Saif El-Sherei. - CVE-2015-1250: Various fixes from internal audits, fuzzing and other initiatives. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
dovecot: denial of service
| Package(s): | dovecot | CVE #(s): | CVE-2015-3420 | ||||||||||||
| Created: | April 29, 2015 | Updated: | May 20, 2015 | ||||||||||||
| Description: | From the Arch Linux advisory:
Dovecot <= 2.2.14 does not correctly handle SSL/TLS handshake failure in the login process, asking OpenSSL to flush a connection that has already been aborted. This results in a crash with some versions of OpenSSL (most likely >= 1.0.2). | ||||||||||||||
| Alerts: |
| ||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-2922 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 23, 2015 | Updated: | July 16, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
Linux kernel built with the IPv6 networking support(CONFIG_IPV6) is vulnerable to setting its 'hop_limit' too low, via the neighbour discovery protocol. It could result in thwarting the IPv6 functionality. An unprivileged user on a local network could use this flaw to cause DoS to a remote system. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2014-9715 CVE-2015-2830 CVE-2015-3331 CVE-2015-3332 CVE-2015-3339 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 27, 2015 | Updated: | July 30, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2014-9715: It was found that the netfilter connection tracking subsystem used too small a type as an offset within each connection's data structure, following a bug fix in Linux 3.2.33 and 3.6. In some configurations, this would lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in violation of the netfilter policy or remote code execution. This can be mitigated by disabling connection tracking accounting: sysctl net.netfilter.nf_conntrack_acct=0 CVE-2015-2830: Andrew Lutomirski discovered that when a 64-bit task on an amd64 kernel makes a fork(2) or clone(2) system call using int $0x80, the 32-bit compatibility flag is set (correctly) but is not cleared on return. As a result, both seccomp and audit will misinterpret the following system call by the task(s), possibly leading to a violation of security policy. CVE-2015-3331: Stephan Mueller discovered that the optimised implementation of RFC4106 GCM for x86 processors that support AESNI miscalculated buffer addresses in some cases. If an IPsec tunnel is configured to use this mode (also known as AES-GCM-ESP) this can lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in remote code execution. CVE-2015-3332: Ben Hutchings discovered that the TCP Fast Open feature regressed in Linux 3.16.7-ckt9, resulting in a kernel BUG when it is used. This can be used as a local denial of service. CVE-2015-3339: It was found that the execve(2) system call can race with inode attribute changes made by chown(2). Although chown(2) clears the setuid/setgid bits of a file if it changes the respective owner ID, this race condition could result in execve(2) setting effective uid/gid to the new owner ID, a privilege escalation. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libksba: denial of service
| Package(s): | libksba | CVE #(s): | |||||||||||||||||
| Created: | April 24, 2015 | Updated: | November 30, 2015 | ||||||||||||||||
| Description: | From the Mageia bug report: Now returns an error instead of terminating the process for certain bad BER encodings. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
libreoffice: code execution
| Package(s): | libreoffice openoffice | CVE #(s): | CVE-2015-1774 | ||||||||||||||||||||||||||||||||||||||||
| Created: | April 27, 2015 | Updated: | August 4, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
It was discovered that missing input sanitising in Libreoffice's filter for HWP documents may result in the execution of arbitrary code if a malformed document is opened. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
network-manager: information disclosure
| Package(s): | network-manager | CVE #(s): | CVE-2015-1322 | ||||
| Created: | April 28, 2015 | Updated: | April 29, 2015 | ||||
| Description: | From the Ubuntu advisory:
Tavis Ormandy discovered that NetworkManager incorrectly filtered paths when requested to read modem device contexts. A local attacker could possibly use this issue to bypass privileges and manipulate modem device configuration or read arbitrary files. | ||||||
| Alerts: |
| ||||||
ntp: denial of service
| Package(s): | ntp | CVE #(s): | CVE-2015-3405 | ||||||||||||||||||||||||||||||||||||
| Created: | April 28, 2015 | Updated: | April 29, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. If the lowest byte of the temp variable is outside of the printable characters range (between 0x20 and 0x7f), the ntp-keygen utility enters an infinite loop. However, if the temp variable is within the aforementioned range, the generated MD5 key will consist of 20 identical characters, meaning only 93 possible keys can be generated. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
oxide-qt: code execution
| Package(s): | oxide-qt | CVE #(s): | CVE-2015-1321 | ||||
| Created: | April 28, 2015 | Updated: | April 29, 2015 | ||||
| Description: | From the Ubuntu advisory:
A use-after-free was discovered in the file picker implementation. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. | ||||||
| Alerts: |
| ||||||
powerdns: denial of service
| Package(s): | powerdns | CVE #(s): | CVE-2015-1868 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 24, 2015 | Updated: | July 22, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory: A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. This loop is capped at a 1000 iterations by a failsafe, making the issue harmless on most platforms. However, on specific platforms, the recursion involved in these 1000 steps causes memory corruption leading to a quick crash, presumably because the default stack is too small. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
python-Pillow: denial of service
| Package(s): | python-Pillow | CVE #(s): | CVE-2014-3598 | ||||
| Created: | April 29, 2015 | Updated: | April 29, 2015 | ||||
| Description: | From the openSUSE advisory:
Remote attackers could cause a denial of service using specially crafted image files via IcnsImagePlugin | ||||||
| Alerts: |
| ||||||
sqlite: three vulnerabilities
| Package(s): | sqlite | CVE #(s): | CVE-2015-3414 CVE-2015-3415 CVE-2015-3416 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 23, 2015 | Updated: | August 18, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Fedora advisory:
[ 1 ] Bug #1212353 - sqlite: use of uninitialized memory when parsing collation sequences in
src/where.c
https://bugzilla.redhat.com/show_bug.cgi?id=1212353 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
t1utils: multiple vulnerabilities
| Package(s): | t1utils | CVE #(s): | CVE-2015-3905 | ||||||||||||||||||||||||||||
| Created: | April 24, 2015 | Updated: | July 10, 2015 | ||||||||||||||||||||||||||||
| Description: | According to the Mageia bug report, t1utils prior to version 1.39 was subject to three separate bugs that could result in a denial of service: a buffer overrun, an infinite loop, and a stack overflow in t1disasm. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
usb-creator: privilege escalation
| Package(s): | usb-creator | CVE #(s): | |||||||||
| Created: | April 24, 2015 | Updated: | April 29, 2015 | ||||||||
| Description: | From the Ubuntu advisory: Tavis Ormandy discovered that usb-creator was missing an authentication check. A local attacker could use this issue to gain elevated privileges. | ||||||||||
| Alerts: |
| ||||||||||
wordpress: multiple vulnerabilities
| Package(s): | wordpress | CVE #(s): | CVE-2015-3438 CVE-2015-3439 CVE-2015-3440 | ||||||||||||||||||||||||||||
| Created: | April 27, 2015 | Updated: | May 21, 2015 | ||||||||||||||||||||||||||||
| Description: | From the WordPress announcement:
WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This was reported by Cedric Van Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team. We also fixed three other security issues:
| ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
wpa_supplicant: code execution
| Package(s): | wpa_supplicant | CVE #(s): | CVE-2015-1863 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 24, 2015 | Updated: | May 13, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory: It was discovered that wpa_supplicant incorrectly handled SSID information when creating or updating P2P peer entries. A remote attacker could use this issue to cause wpa_supplicant to crash, resulting in a denial of service, expose memory contents, or possibly execute arbitrary code. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
yourls: cross-site scripting
| Package(s): | yourls | CVE #(s): | CVE-2014-8488 | ||||||||
| Created: | April 29, 2015 | Updated: | April 29, 2015 | ||||||||
| Description: | From the CVE entry:
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality. | ||||||||||
| Alerts: |
| ||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>