CVE-2015-7547: Critical Vulnerability in glibc getaddrinfo

[Oleksandr Liemieshko]

All versions of glibc after 2.9 are vulnerable

https://isc.sans.edu/forums/diary/CVE20157547+Critical+Vulnerability+in+glibc+getaddrinfo/20737/

for examples in MOS 6.0 we have:

[root@nailgun ~]# yum list |grep glibc
glibc.x86_64 2.12-1.132.el6_5.2 @anaconda-CentOS-201410241409.x86_64/6.3
glibc-common.x86_64 2.12-1.132.el6_5.2 @anaconda-CentOS-201410241409.x86_64/6.3
glibc-devel.x86_64 2.12-1.132.el6_5.2 nailgun
glibc-headers.x86_64 2.12-1.132.el6_5.2 nailgun

from one of the nodes:
Warning: Permanently added 'node-1' (RSA) to the list of known hosts.
ii libc-bin 2.15-0ubuntu10.7 Embedded GNU C Library: Binaries
ii libc-dev-bin 2.15-0ubuntu10.7 Embedded GNU C Library: Development binaries
ii libc6 2.15-0ubuntu10.7 Embedded GNU C Library: Shared libraries
ii libc6-dev 2.15-0ubuntu10.7 Embedded GNU C Library: Development Libraries and Header Files(edited)

[Adam Heczko (aheczko-mirantis)]

According to CVSS this is of score 8.3.
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Changing importance to 'High'

[Adam Heczko (aheczko-mirantis)]

Just to clarify:
IMO we are supposed to provide updates for all MOS versions which can't consume updates from upstream.
It affects Fuel (CentOS) as well as slaves: CentOS / Ubuntu.

[Thomas Goirand (thomas-goirand)]

At this point in time, with exploits in the wild [1], there's no reason to keep this bug as "Private security". Please open the bug, and act transparently, we don't want/need to uselessly keep this one undisclosed, I'd see it as being dishonest to our users.

[1] https://github.com/fjserna/CVE-2015-7547

[Artem Silenkov (asilenkov)]

1. Centos6.3 already contains fixed package
glibc-2.12-1.166.el6_7.7.rpm

Patches related:
glibc-rh1296031-0.patch
glibc-rh1296031.patch

Fixes applied were:
http://paste.openstack.org/show/487786/

This list is quite long, upgrade to upstream version is risky without deep testing.

2. Two CVE related patches could be applied with manual offset tuning. It could be applied smoothly, only offset is different but not the code. However, this operation is risky without deep testing.

We should decide what to do next.

All upstreams mentioned have this fix applied in upstream in updates repo. Backporting is possible for sure but with no guarantees.

[Artem Silenkov (asilenkov)]

I'd better stick with backporting the whole package but not two patches.

I don't have 6.0, only 6.1.
6.1 is working for me with backported 2.12-1.166 glibc from upstream.

Not sure if simply adding update repo is safe enough.

[Dmitry Teselkin (teselkin-d)]

CentOS-6.7 contains updated package, not 6.3.

We should try to use upstream version first, and not rebuild the package until we found that there is no other way.

Adding upstream update repo is not possible without extra configuration. However, it might work if made correctly.

[Denis Meltsaykin (dmeltsaykin)]

This bug will be covered by a security bulletin which is expected to be released in the near future.

[Vitaly Sedelnik (vsedelnik)]

Nominated to 8.0.x and 9.0.x series, targeted to 8.0-mu-1 and 9.0. Looks like we have to update tech bulletin with information for 8.0 and make sure the updated glibc gets landed into 9.0

[Dmitry Teselkin (teselkin-d)]

9.0+ is based on CentOS-7.2 where this issue was fixed.

[Dmitry Teselkin (teselkin-d)]

Packages for 8.0 http://172.18.10.67/RHSA-2016_0175-1-c7x64.tar.gz

[Denis Meltsaykin (dmeltsaykin)]

The security bulletin has been released: https://content.mirantis.com/rs/451-RBY-185/images/Mirantis-Technical-Bulletin-glibc-security.pdf
Closing as Fix released.