Bug 1226132 - CVE-2024-38445: ocf, ceph: information leak due to incorrect memset() usage
Summary: CVE-2024-38445: ocf, ceph: information leak due to incorrect memset() usage
Status: RESOLVED FIXED
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Wolfgang Frisch
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-10 08:55 UTC by Wolfgang Frisch
Modified: 2024-06-17 07:41 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2024-06-10 08:55:47 UTC
src/spdk/ocf/env/posix/ocf_env.h in openSUSE:Factory/ceph contains a function that's supposed to zero sensitive buffers but fails due incorrect usage of memset:

181 static inline void env_secure_free(const void *ptr, size_t size)
182 {
183     if (ptr) {
184 #if SECURE_MEMORY_HANDLING
185         memset(ptr, size, 0);
186         /* TODO: flush CPU caches ? */
187         ENV_BUG_ON(munlock(ptr));
188 #endif
189         free((void*)ptr);
190     }
191 }

It writes "size" zero times instead of \0 "size" times.

This code path is currently inactive, though it should be fixed in case anyone ever decides to enable it.
Comment 2 Wolfgang Frisch 2024-06-11 07:01:14 UTC
Upstream: https://github.com/Open-CAS/ocf/
(ocf is embedded in ceph)
Comment 4 Wolfgang Frisch 2024-06-11 11:12:54 UTC
Affected copies of `ocf` are present in:

openSUSE:Factory/ceph
SUSE:SLFO:Main/ceph
SUSE:ALP:Source:Standard:1.0/ceph
SUSE:SLE-15-SP4:Update/ceph
SUSE:SLE-15-SP4:GA/ceph
SUSE:SLE-15-SP3:Update/ceph
SUSE:SLE-15-SP2:Update/ceph
SUSE:SLE-15-SP2:GA/ceph

NOTE: The affected code path is *inactive* in all our ceph packages, so the fix is not urgent.
Comment 5 Wolfgang Frisch 2024-06-11 11:26:44 UTC
CRD: 2024-09-09
preliminary, probably earlier
Comment 9 Wolfgang Frisch 2024-06-13 07:15:45 UTC
Requested a CVE from Mitre with the following justification:
- Weakness: CWE-226: Sensitive Information in Resource Not Removed Before Reuse
- Attack vector: OCF is a caching library intended to be embedded in multi-user systems such as Ceph. If env_secure_free() fails to clear cache metadata, information might get leaked across security boundaries.
- Description: Open CAS Framework (ocf) versions 19.3.1 through 22.3.2 contains an optional SECURE_MEMORY_HANDLING mode that fails to clear freed memory.
Comment 10 Wolfgang Frisch 2024-06-17 07:41:25 UTC
CVE-2024-38445 was assigned by Mitre and upstream fixed the issue:
https://github.com/Open-CAS/ocf/commit/5975bb8822a24e6ab5a9a59ab1d6441321c7693d

Resolved.