Problem med arc4random i FreeBSD

Joachim Strömbergson — Wed, 03 Dec 2008 15:44:12 +0000

Enligt en säkerhetsrapport från FreeBSD-projektet finns det ett problem med slumptalsgeneratorn arc4random.

Säkerhetsrapporten FreeBSD-SA-08.11.arc4random beskriver problemet så här:

I. Background
arc4random(9) is a generic-purpose random number generator based on the key stream generator of the RC4 cipher. It is expected to be cryptographically strong, and used throughout the FreeBSD kernel for a variety of purposes, some of which rely on its cryptographic strength.

arc4random(9) is periodically reseeded with entropy from the FreeBSD kernel’s Yarrow random number generator, which gathers entropy from a variety of sources including hardware interrupts. During the boot process, additional entropy is provided to the Yarrow random number generator from userland, helping to ensure that adequate entropy is present for cryptographic purposes.

II. Problem Description
When the arc4random(9) random number generator is initialized, there may be inadequate entropy to meet the needs of kernel systems which rely on arc4random(9); and it may take up to 5 minutes before arc4random(9) is reseeded with secure entropy from the Yarrow random number generator.

III. Impact
All security-related kernel subsystems that rely on a quality random number generator are subject to a wide range of possible attacks for the 300 seconds after boot or until 64k of random data is consumed. The list includes:

GEOM ELI providers with onetime keys. When a provider is configured in a way so that it gets attached at the same time during boot (e.g. it uses the rc subsystem to initialize) it might be possible for an attacker to recover the encrypted data.

GEOM shsec providers. The GEOM shsec subsytem is used to split a shared secret between two providers so that it can be recovered when both of them are present. This is done by writing the random sequence to one of providers while appending the result of the random sequence on the other host to the original data. If the provider was created within the first 300 seconds after booting, it might be possible for an attacker to extract the original data with access to only one of the two providers between which the secret data is split.

System processes started early after boot may receive predictable IDs.

The 802.11 network stack uses arc4random(9) to generate initial vectors (IV) for WEP encryption when operating in client mode and WEP authentication challenges when operating in hostap mode, which may be insecure.

The IPv4, IPv6 and TCP/UDP protocol implementations rely on a quality random number generator to produce unpredictable IP packet identifiers, initial TCP sequence numbers and outgoing port numbers. During the first 300 seconds after booting, it may be easier for an attacker to execute IP session hijacking, OS fingerprinting, idle scanning, or in some cases DNS cache poisoning and blind TCP data injection attacks.

The kernel RPC code uses arc4random(9) to retrieve transaction identifiers, which might make RPC clients vulnerable to hijacking

IV. Workaround
No workaround is available for affected systems.

V. Solution
NOTE WELL: Any GEOM shsec providers which were created or written to
during the first 300 seconds after booting should be re-created after
applying this security update.

Perform one of the following:
1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the RELENG_7_0, or RELENG_6_3 security branch dated after the correction date.

2) To patch your present system:
The following patches have been verified to apply to FreeBSD 6.3 and 7.0 systems.

a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility.

[FreeBSD 7.x]

fetch http://security.FreeBSD.org/patches/SA-08:11/arc4random.patch

fetch http://security.FreeBSD.org/patches/SA-08:11/arc4random.patch.asc

[FreeBSD 6.x]

fetch http://security.FreeBSD.org/patches/SA-08:11/arc4random6x.patch

fetch http://security.FreeBSD.org/patches/SA-08:11/arc4random6x.patch.asc

b) Apply the patch.

cd /usr/src

patch < /path/to/patch

c) Recompile your kernel as described in
and reboot the system.

Kör du FreeBSD, och speciellt om du använder GEOM och GBDE bör du patcha eller uppgradera ditt system (om du inte redan gjort det).

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Kryptoblog » FreeBSD

Problem med arc4random i FreeBSD