yahoo-eng-team team mailing list archive

[Tristan Cacqueray <tdecacqu@xxxxxxxxxx>]

*** This bug is a security vulnerability ***

Public security bug reported:

This have been reported by Daniel P. Berrange:
"
In the OpenStack Liberty release, the Glance project added support for image signature verification.

http://specs.openstack.org/openstack/glance-specs/specs/liberty/image-
signing-and-verification-support.html

The verification code was added in the following git commit

https://github.com/openstack/glance/commit/484ef1b40b738c87adb203bba6107ddb4b04ff6e


Unfortunately the design of this signature verification method is flawed by design.

The generalized approach to creating signatures of content is to apply a
hash to the content and then encrypt it in some manner. Consider that
the signature is defined to use hash=sha256 and cipher=rsa we can
describe the signature computation as

signature = rsa(sha256(content))

In the case of verifying a disk image, the content we care about
verifying is the complete disk image file. Unfortunately, the glance
specification chose *not* to compute the signature against the disk
image file. Glance already had an MD5 checksum calculated for the disk
image file, so they instead chose to compute the signature against the
MD5 checksum instead. ie glance is running

signature = rsa(sha256(md5(disk-image-content)))

This degrades the security of the system to that of the weakest hash,
which is obviously MD5 here.

The code where glance verifies the signature is in the
glance/locations.py, the 'set_data' method where is does

 result = signature_utils.verify_signature(
 self.context, checksum, self.image.extra_properties)
 if result:
 LOG.info(_LI("Successfully verified signature for image %s"),
 self.image.image_id)

The 'checksum' variable is populate by the glance_store driver, but it
is hardcoded to always be md5 in all current glance storage backends:

 $ git grep hashlib glance_store/_drivers/ | grep checksum
 glance_store/_drivers/filesystem.py: checksum = hashlib.md5()
 glance_store/_drivers/rbd.py: checksum = hashlib.md5()
 glance_store/_drivers/s3.py: checksum = hashlib.md5()
 glance_store/_drivers/s3.py: checksum = hashlib.md5()
 glance_store/_drivers/sheepdog.py: checksum = hashlib.md5()
 glance_store/_drivers/swift/store.py: checksum =
 hashlib.md5()
 glance_store/_drivers/vmware_datastore.py: self.checksum =
 hashlib.md5()


Since we will soon be shipping OpenStack Liberty release, we need to at least give a security notice to alert our customers to the fact that the signature verification is cryptographically weak/broken. IMHO, it quite likely deserves a CVE though

NB, this is public knowledge as I first became aware of this flawed
design in comments / discussion on a public specification proposed to
implement the same approach in the Nova project.

My suggested way to fix this is to simply abandon the current impl and
re-do it such that it directly computes the signature against  the disk
image, and does not use the existing md5 checksum in any way.

Regards,
Daniel
"

Mailing list thread for Nova impl: http://lists.openstack.org/pipermail/openstack-dev/2015-November/079348.html
Nova Spec: https://review.openstack.org/#/c/188874/

** Affects: glance
     Importance: Undecided
         Status: New

** Affects: ossa
     Importance: Undecided
         Status: Incomplete

** Also affects: ossa
   Importance: Undecided
       Status: New

** Changed in: ossa
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1516031

Title:
  Use of MD5 in OpenStack Glance image signature

Status in Glance:
  New
Status in OpenStack Security Advisory:
  Incomplete

Bug description:
  This have been reported by Daniel P. Berrange:
  "
  In the OpenStack Liberty release, the Glance project added support for image signature verification.

  http://specs.openstack.org/openstack/glance-specs/specs/liberty/image-
  signing-and-verification-support.html

  The verification code was added in the following git commit

  https://github.com/openstack/glance/commit/484ef1b40b738c87adb203bba6107ddb4b04ff6e

  
  Unfortunately the design of this signature verification method is flawed by design.

  The generalized approach to creating signatures of content is to apply
  a hash to the content and then encrypt it in some manner. Consider
  that the signature is defined to use hash=sha256 and cipher=rsa we can
  describe the signature computation as

  signature = rsa(sha256(content))

  In the case of verifying a disk image, the content we care about
  verifying is the complete disk image file. Unfortunately, the glance
  specification chose *not* to compute the signature against the disk
  image file. Glance already had an MD5 checksum calculated for the disk
  image file, so they instead chose to compute the signature against the
  MD5 checksum instead. ie glance is running

  signature = rsa(sha256(md5(disk-image-content)))

  This degrades the security of the system to that of the weakest hash,
  which is obviously MD5 here.

  The code where glance verifies the signature is in the
  glance/locations.py, the 'set_data' method where is does

   result = signature_utils.verify_signature(
   self.context, checksum, self.image.extra_properties)
   if result:
   LOG.info(_LI("Successfully verified signature for image %s"),
   self.image.image_id)

  The 'checksum' variable is populate by the glance_store driver, but it
  is hardcoded to always be md5 in all current glance storage backends:

   $ git grep hashlib glance_store/_drivers/ | grep checksum
   glance_store/_drivers/filesystem.py: checksum = hashlib.md5()
   glance_store/_drivers/rbd.py: checksum = hashlib.md5()
   glance_store/_drivers/s3.py: checksum = hashlib.md5()
   glance_store/_drivers/s3.py: checksum = hashlib.md5()
   glance_store/_drivers/sheepdog.py: checksum = hashlib.md5()
   glance_store/_drivers/swift/store.py: checksum =
   hashlib.md5()
   glance_store/_drivers/vmware_datastore.py: self.checksum =
   hashlib.md5()

  
  Since we will soon be shipping OpenStack Liberty release, we need to at least give a security notice to alert our customers to the fact that the signature verification is cryptographically weak/broken. IMHO, it quite likely deserves a CVE though

  NB, this is public knowledge as I first became aware of this flawed
  design in comments / discussion on a public specification proposed to
  implement the same approach in the Nova project.

  My suggested way to fix this is to simply abandon the current impl and
  re-do it such that it directly computes the signature against  the
  disk image, and does not use the existing md5 checksum in any way.

  Regards,
  Daniel
  "

  Mailing list thread for Nova impl: http://lists.openstack.org/pipermail/openstack-dev/2015-November/079348.html
  Nova Spec: https://review.openstack.org/#/c/188874/

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1516031/+subscriptions