Resource management error in etcd - CVE-2020-15106

Vulnerability identifier: #VU41650

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15106

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources with the application, as a large slice causes panic in decodeRecord method. A remote attacker can  forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

etcd
IBM Cloud Pak for Security
Red Hat OpenStack for IBM Power
Red Hat OpenStack
QRadar Suite
IBM Edge Application Manager
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
openSUSE Leap
Ubuntu
Fedora
etcd-server (Ubuntu package)
etcd-client (Ubuntu package)
etcd (Ubuntu package)
etcd (Red Hat package)
etcd
etcdctl

Install updates from vendor's website.

etcd - addressed in versions 3.3.23, 3.4.10
QRadar Suite - update to 1.10.19.0
etcd-server (Ubuntu package) - update to 3.2.26+dfsg-6ubuntu0.1
etcd-client (Ubuntu package) - update to 3.2.26+dfsg-6ubuntu0.1
etcd (Ubuntu package) - update to 3.2.26+dfsg-6ubuntu0.1
etcd (Red Hat package) - addressed in versions 3.2.32-1.el7_9, 3.3.23-1.el8ost
etcd - update to 3.4.13-1.fc32
etcdctl - update to 3.5.12-150000.7.6.1
etcd - update to 3.5.12-150000.7.6.1

• https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2

• Multiple vulnerabilities in etcd
• Red Hat Enterprise Linux 7 Extras update for etcd
• Ubuntu update for etcd
• Red Hat OpenStack Platform 16 update for etcd
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar Suite Software
• SUSE update for etcd
• Fedora 32 update for etcd