Bugzilla – Bug 1038984
VUL-0: CVE-2017-7435, CVE-2017-7436: libzypp: rpm-md repository security downgrade
Last modified: 2018-09-11 16:09:47 UTC
TLL;DR: It's possible to replace a signed rpm-md repository with an unsigned one and the machine using it will not notice. This is a long set of infortunate choices, which degrade repository security: 1. gpgcheck=1 in /etc/zypp/repos.d/ defaults to both repo_gpgcheck=1 and pkg_gpgcheck=1 at configuration parsing. 2. Package downloader is satisfied by either of the conditions enabled - signature of either repository or of the package. Since pkg_gpgcheck is 1 by default, it accepts an unsigned repository. 3. libzypp checks signatures on the downloaded package, and it relies on rpm to do the verification. Since rpm does not find any signature in the package, but the checksums are correct, it returns that the package is fine. 4. Package gets installed Thus an example rpm-md repository, which had the repository signed (and perhaps even packages), like this: [repo] name=An rpm-md repository enabled=1 autorefresh=1 baseurl=http://repo.example.com/ type=rpm-md gpgcheck=1 can be directed (by the way of DNS, IP spoofing, or remote server compromise), to an unsigned repository with unsigned packages. The gpgcheck=1 option suggests that we are ensuring some kind of GPG verification of the package origin, thus we should be safe from using unencrypted HTTP - after all, the package repository contents are not secret, thus no need for encryption. Using HTTPS would make it harder to do IP or DNS spoofing. ad. 1. zypp.conf: ## Signature checking (repodata and rpm packages) ## ## boolean gpgcheck (default: on) ## boolean repo_gpgcheck (default: unset -> according to gpgcheck) ## boolean pkg_gpgcheck (default: unset -> according to gpgcheck) ad. 2. According to https://github.com/openSUSE/zypper/issues/70, in version libzypp-15.3.0 there was a change which allowed to have *either* the rpm-md repository signed, or the package - libzypp commit 4fdccab4b649d23bf5e2e7b33c2bc4dc412d2482: if ( repoInfo().repoGpgCheck() ) { if ( isSigned || !repoInfo().pkgGpgCheck() ) So if pkg_gpgcheck is enabled (it is by default), libzypp will not care about repository being signed or not. ad. 3. zypp/target/rpm/RpmDb.c calls ::rpmVerifySignatures for the downloaded package: qva.qva_flags = (VERIFY_DIGEST|VERIFY_SIGNATURE); int res = ::rpmVerifySignatures( &qva, ts, fd, path_r.basename().c_str() ); Tracing the call to rpm, rpmVerifySignatures is a wrapper around rpmpkgVerifySigs. which is also called from rpmkeys.c. Basically running: rpmkeys -K $package is an equivalent, as it sets the same flags to rpmpkgVerifySigs. As one can test, rpmkeys -K is pretty happy about packages that don't contain a signature at all - all the checksums pass, so it exits with a 0 return code, the same way rpmVerifySignatures returns the information that the package is OK. --- The problem does not directly affect the yast2 repositories, as zypper pointed to an unsigned yast2 repository prints a warning about missing signature: File 'content' from repository 'openSUSE-42.2_OSS' is unsigned, continue? [yes/no] (no): Ignoring this warning installs an unsigned package, but it's better than not issuing a warning at all, like the rpm-md case. It seems the only workaround for now to make sure the repository signature is verified currently is to explicitly set pkg_gpgcheck=0 for the repository.
yes, that is problematic behavior. I would suggest that we separate this. So the user has a new setting to accept unsigned repos without confirming it and the existing setting gpgcheck without using it in the way described in the original report to skip the signing checks.
(In reply to Bolesław Tokarski from comment #0) > 1. gpgcheck=1 in /etc/zypp/repos.d/ defaults to both repo_gpgcheck=1 and > pkg_gpgcheck=1 at configuration parsing. > ad. 1. > zypp.conf: > ## Signature checking (repodata and rpm packages) > ## > ## boolean gpgcheck (default: on) > ## boolean repo_gpgcheck (default: unset -> according to gpgcheck) > ## boolean pkg_gpgcheck (default: unset -> according to gpgcheck) Not exactly: repo_gpgcheck and pkg_gpgcheck are TriBool values. If you do not explicitly set them ON/OFF, they are 'indeterminate'. The default for 'indeterminate' is to enforce the package gpg check, if the repo metadata are not signed. If the metadata are signed, it's sufficient that the package matches the checksum stored in the metadata. Explicitly setting repo_gpgcheck/pkg_gpgcheck to ON/OFF should always perform/skip the corresponding check. > 2. Package downloader is satisfied by either of the conditions enabled - > signature of either repository or of the package. Since pkg_gpgcheck is 1 by > default, it accepts an unsigned repository. You are right, if pkg_gpgcheck is ON, then unsigned repos are accepted even if repo_gpgcheck is ON as well. This needs to be fixed; repo_gpgcheck=ON must not accept unsigned repos. > 3. libzypp checks signatures on the downloaded package, and it relies on rpm > to do the verification. Since rpm does not find any signature in the > package, but the checksums are correct, it returns that the package is fine. This needs to be fixed as well.
(In reply to Michael Andres from comment #2) > This needs to be fixed; repo_gpgcheck=ON must not accept unsigned repos. This is CVE-2017-7435 > Since rpm does not find any signature in the > package, but the checksums are correct, it returns that the package is fine. This is CVE-2017-7436
libzypp-16.15.0 / zypper-1.13.30 provide the required behavioral changes. Fixes also bug #1045735. Zypper may need some more polishing regarding prompt and message texts. > boolean gpgcheck (default: on) > boolean repo_gpgcheck (default: unset -> according to gpgcheck) > boolean pkg_gpgcheck (default: unset -> according to gpgcheck) > > Explicitly setting 'gpgcheck', 'repo_gpgcheck' 'pkg_gpgcheck' in a > repositories .repo file will overwrite the defaults for this specific > repo. > > If 'gpgcheck' is 'on' (the default) we will check the signature of repo metadata > (packages are secured via checksum inside the metadata). Using unsigned repos > needs to be confirmed. > Packages from signed repos are accepted if their checksum matches the checksum > stated in the repo metadata. > Packages from unsigned repos need a valid gpg signature, using unsigned packages > needs to be confirmed. > > The above default behavior can be tuned by explicitly setting 'repo_gpgcheck' > and/or 'pkg_gpgcheck': > > 'repo_gpgcheck = on' same as the default. > > 'repo_gpgcheck = off' will silently accept unsigned repos. It will NOT turn of > signature checking on the whole, nevertheless it's not a secure setting. > > 'pkg_gpgcheck = on' will enforce the package signature checking and the need > to confirm unsigned packages for all repos (signed and unsigned). > > 'pkg_gpgcheck = off' will silently accept unsigned packages. It will NOT turn of > signature checking on the whole, nevertheless it's not a secure setting. > > If 'gpgCheck' is 'off' (not recommended), no checks are performed. You can still > enable them individually by setting 'repo_gpgcheck' and/or 'pkg_gpgcheck' to 'on'.
Submitted MR for Factory and SLE12SP2 (omitted SP3)
(In reply to Michael Andres from comment #13) > Submitted MR for Factory and SLE12SP2 (omitted SP3) This might break SUSE Manager. Just say'in ...
For the SUMA case: For a short period of time, libzypp-16.15.(>=2) will silently accept unsigned packages IFF a repositories gpgcheck configuration is explicitly turned OFF like this (the SUMA case): > gpgcheck = 0 > repo_gpgcheck = 0 > pkg_gpgcheck = 1 This will allow already released products to adapt to the behavioral changes introduced by fixing this bug, while systems with a default configuration (gpgcheck = 1) already benefit from the fix in libzypp-16.15.*. With libzypp-16.16.* the above configuration will reject unsigned packages as it is supposed to do.
SUSE-SU-2017:2040-1: An update that solves three vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1009745,1031756,1033236,1038132,1038984,1043218,1045735,1047785,1048315 CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libzypp-16.15.2-27.21.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): libzypp-16.15.2-27.21.1, zypper-1.13.30-18.13.3 SUSE Linux Enterprise Server 12-SP2 (src): libzypp-16.15.2-27.21.1, zypper-1.13.30-18.13.3 SUSE Linux Enterprise Desktop 12-SP2 (src): libzypp-16.15.2-27.21.1, zypper-1.13.30-18.13.3 OpenStack Cloud Magnum Orchestration 7 (src): libzypp-16.15.2-27.21.1, zypper-1.13.30-18.13.3
openSUSE-SU-2017:2111-1: An update that solves three vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1009745,1031756,1033236,1038132,1038984,1043218,1045735,1047785,1048315 CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269 Sources used: openSUSE Leap 42.2 (src): libzypp-16.15.2-5.9.1, zypper-1.13.30-5.9.1
New options to add-repo/modify-repo, to allow setting the gpg check options according to your needs have been added in zypper-1.13.31 (see also bug #1045735#c16)
Fixed in zypper-1.13.31
Submitted for SLES12-SP2/3 (Leap-42.2/3) and Tumbleweed
SUSE-SU-2017:2264-1: An update that solves three vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 1009745,1036659,1038984,1043218,1045735,1046417,1047785,1048315 CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP3 (src): libzypp-16.15.3-2.3.1, yast2-pkg-bindings-devel-doc-3.2.4-2.3.1 SUSE Linux Enterprise Server 12-SP3 (src): libzypp-16.15.3-2.3.1, yast2-pkg-bindings-3.2.4-2.3.1 SUSE Linux Enterprise Desktop 12-SP3 (src): libzypp-16.15.3-2.3.1, yast2-pkg-bindings-3.2.4-2.3.1
openSUSE-SU-2017:2335-1: An update that solves three vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 1009745,1036659,1038984,1043218,1045735,1046417,1047785,1048315 CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269 Sources used: openSUSE Leap 42.3 (src): libzypp-16.15.3-9.1, yast2-pkg-bindings-3.2.4-4.1, yast2-pkg-bindings-devel-doc-3.2.4-4.1
SUSE-SU-2017:2344-1: An update that solves one vulnerability and has 6 fixes is now available. Category: security (important) Bug References: 1008325,1038984,1045735,1047785,1054088,1054671,1055920 CVE References: CVE-2017-7436 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP3 (src): libzypp-16.15.6-2.8.1 SUSE Linux Enterprise Server 12-SP3 (src): libzypp-16.15.6-2.8.1, zypper-1.13.32-21.3.2 SUSE Linux Enterprise Desktop 12-SP3 (src): libzypp-16.15.6-2.8.1, zypper-1.13.32-21.3.2
openSUSE-SU-2017:2370-1: An update that solves one vulnerability and has 6 fixes is now available. Category: security (important) Bug References: 1008325,1038984,1045735,1047785,1054088,1054671,1055920 CVE References: CVE-2017-7436 Sources used: openSUSE Leap 42.3 (src): libzypp-16.15.6-12.1, zypper-1.13.32-8.1
SUSE-SU-2017:2470-1: An update that solves 18 vulnerabilities and has 46 fixes is now available. Category: security (important) Bug References: 1004995,1009745,1014471,1017420,1019637,1026825,1027079,1027688,1027908,1028281,1028723,1029523,1031756,1032706,1033236,1035062,1036659,1038132,1038444,1038984,1042392,1043218,1043333,1044095,1044107,1044175,1044840,1045384,1045735,1045987,1046268,1046417,1046659,1046853,1046858,1047008,1047236,1047240,1047310,1047379,1047785,1047964,1047965,1048315,1048483,1048605,1048679,1048715,1049344,1050396,1050484,1051626,1051643,1051644,1052030,1052759,1053409,874665,902364,938657,944903,954661,960820,963041 CVE References: CVE-2013-7459,CVE-2016-9063,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-10684,CVE-2017-10685,CVE-2017-11112,CVE-2017-11113,CVE-2017-3308,CVE-2017-3309,CVE-2017-3453,CVE-2017-3456,CVE-2017-3464,CVE-2017-7435,CVE-2017-7436,CVE-2017-8872,CVE-2017-9233,CVE-2017-9269 Sources used: SUSE Container as a Service Platform ALL (src): caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3, container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3, sles12-mariadb-docker-image-1.1.0-2.3.10, sles12-pause-docker-image-1.1.0-2.3.11, sles12-pv-recycler-node-docker-image-1.1.0-2.3.10, sles12-salt-api-docker-image-1.1.0-2.3.9, sles12-salt-master-docker-image-1.1.0-4.3.10, sles12-salt-minion-docker-image-1.1.0-2.3.8, sles12-velum-docker-image-1.1.0-4.3.9
Fixed in SLES12-SP1 libzypp 15.25.16 zypper 1.12.58 (MR#170947) SLES12 libzypp 14.45.16 zypper 1.11.70 (MR#170948)
SUSE-SU-2018:2555-1: An update that solves four vulnerabilities and has 10 fixes is now available. Category: security (important) Bug References: 1037210,1038984,1045735,1048315,1054088,1070851,1076192,1088705,1091624,1092413,1096803,1100028,1101349,1102429 CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269,CVE-2018-7685 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): libzypp-15.25.17-46.22.1, zypper-1.12.59-46.10.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): libzypp-15.25.17-46.22.1, zypper-1.12.59-46.10.1
SUSE-SU-2018:2688-1: An update that solves four vulnerabilities and has 13 fixes is now available. Category: security (important) Bug References: 1036304,1037210,1038984,1045735,1048315,1054088,1070851,1076192,1079334,1088705,1091624,1092413,1096803,1099847,1100028,1101349,1102429 CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269,CVE-2018-7685 Sources used: SUSE Linux Enterprise Server 12-LTSS (src): libzypp-14.45.17-2.82.1, zypper-1.11.70-2.69.2