- Download Diff

Summary:

Bug 558 - Apply mitigation on CVE-2023-48795

Review Request #286 — Created June 14, 2024 and submitted June 18, 2024, 3:45 p.m.

Information
Owner:	luhsuan
Repository:	APV10
Branch:	rel_apv_10_7
Bugs:	558
Depends On:
Reviewers
Groups:
People:	jasonchou, milliechou, timlai, weikai

Description

As it needs a lot of re-working to eliminate CVE-2023-48795.
We instead apply a mitigation to address CVE-2023-48795 by disabling the following encryptions and MACs by default:

Encryption
- chacha20-poly1305@openssh.com
MAC
- the MACs with -etm@openssh.com suffix.

For more information, you may find on this NIST report.

Testing Done


Nexus vulnerability scanning
PASSED (report by @timlai).


connection test with specified encryption (ssh <server name> -c <encryption>)
PASSED (the server should reject the connection)


connection test with specified MAC (ssh <server name> -m <MAC>)
PASSED (the server should reject the connection)


APV terminal output of ssh cipher
PASSED (should show New ciphers, separated by commas. Supported ciphers are:aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com)

Issues

Description	From	Last Updated
可以多加ui_ssh_ciphers function跟DEFAULT_SSH_CIPHERS變數還有修改ssh configuration file(sshd_config) 做MAC的指定	jasonchou	June 17, 2024, 10:51 a.m.
changes to sys_cmd.c is not apperaring, can you please fix the same.	kdutta	June 18, 2024, 11:43 a.m.
Hi Reviewers, Should we change the output message of ssh cipher as well as the document? I think showing chacha20-poly1305@openssh.com …	luhsuan	June 18, 2024, 1:52 p.m.
Check wether doc also need to update	timlai	June 18, 2024, 1:56 p.m.

```
漏掉的部分
```

Show all issues

可以多加ui_ssh_ciphers function跟DEFAULT_SSH_CIPHERS變數
還有修改ssh configuration file(sshd_config) 做MAC的指定

luhsuan June 17, 2024, 8:52 a.m.

Hi Jason,

Thanks for the advice.
As APV uses some mysterious way to create the default sshd_config.
May you provide some guides that how APV create the default sshd_config?

luhsuan June 17, 2024, 10:52 a.m.

Hi Jason,

Nevermind, I just set the DEFAULT_SSH_CIPHERS and only the ciphers in DEFAULT_SSH_CIPHERS will be enable by default.

Description:

		As it needs a lot of re-working to eliminate CVE-2023-48795.
~		We instead apply a mitigation to address CVE-2023-48795 by disabling certain encryptions and HMACs.
	~	We instead apply a mitigation to address CVE-2023-48795 by disabling certain encryptions and HMACs.

		For more information, you may find on this NIST report.

Description:

		As it needs a lot of re-working to eliminate CVE-2023-48795.
~		We instead apply a mitigation to address CVE-2023-48795 by disabling certain encryptions and HMACs.
	~	We instead apply a mitigation to address CVE-2023-48795 by disabling the following encryptions and MACs by default:
	+
	+	Encryption `chacha20-poly1305@openssh.com`
	+	MAC the MACs with `-etm@openssh.com` suffix.

		For more information, you may find on this NIST report.

Testing Done:

		Nexus vulnerability scanning PASSED (report by @timlai).
~		connection test (check the `Server: Key Exchange Init` Info packet captured by Wireshark) PASSED (report by @Lu-Hsuan Chen).
	~	connection test with specifying encryption (`ssh <server name> -c <encryption>`) PASSED
	+	connection test with specifying HMAC (`ssh <server name> -m <HMAC>`) PASSED

Diff:

Revision 2 (+22 -2)

Show changes

	branches/rel_apv_10_7/usr/click/bin/backend/sys_cmd.c
	branches/rel_apv_10_7/usr/click/bin/openssh/CVE-2023-48795-mitigation.patch
	branches/rel_apv_10_7/usr/click/bin/openssh/build.sh

Testing Done:

		Nexus vulnerability scanning PASSED (report by @timlai).
~		connection test with specifying encryption (`ssh <server name> -c <encryption>`) PASSED
~		connection test with specifying HMAC (`ssh <server name> -m <HMAC>`) PASSED
	~	connection test with specified encryption (`ssh <server name> -c <encryption>`) PASSED (the server should reject the connection)
	~	connection test with specified MAC (`ssh <server name> -m <MAC>`) PASSED (the server should reject the connection)

Show all issues

Hi Reviewers,

Should we change the output message of ssh cipher as well as the document?
I think showing chacha20-poly1305@openssh.com will lead to confusion.

luhsuan June 18, 2024, 1:51 p.m.

Done. Remove the showing chacha20-poly1305@openssh.com message.

Ship it!

```
Ship It!
```

Fix it!

Show all issues

changes to sys_cmd.c is not apperaring, can you please fix the same.

luhsuan June 18, 2024, 11:48 a.m.

Hi Ansuk,

It seems that it is the issue or ReviewBoard.
You may use the "Download Diff" tab to download the patch then review it instead.

luhsuan June 18, 2024, 11:48 a.m.

What's more, I will ask the TW IT department to realize the cause of this issue.

Testing Done:

		Nexus vulnerability scanning PASSED (report by @timlai).
		connection test with specified encryption (`ssh <server name> -c <encryption>`) PASSED (the server should reject the connection)
		connection test with specified MAC (`ssh <server name> -m <MAC>`) PASSED (the server should reject the connection)
	+	APV terminal output of `ssh cipher` PASSED (should show `New ciphers, separated by commas. Supported ciphers are:aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com`)

Change Summary:

Remove spaces.

Diff:

Revision 3 (+24 -4)

Show changes

	branches/rel_apv_10_7/usr/click/bin/backend/sys_cmd.c
	branches/rel_apv_10_7/usr/click/bin/openssh/CVE-2023-48795-mitigation.patch
	branches/rel_apv_10_7/usr/click/bin/openssh/build.sh
	branches/rel_apv_10_7/usr/click/lib/libparser/commands.pm

Fix it!

branches/rel_apv_10_7/usr/click/lib/libparser/commands.pm (Diff revision 3)

Show all issues

Check wether doc also need to update

luhsuan June 18, 2024, 1:59 p.m.

Hi Tim,

For the document, are there any procedures for updating?
I thought Simon will decide whether the document need to be updated, and Anja will write the changes.

luhsuan June 18, 2024, 3:42 p.m.

Hi Tim,

Thanks for the talk.
I will talk to Anja to know the procedures of updating the document.

Ship it!

```
Ship It!
```

You have a pending review.

Review Board 5.0.5

Bug 558 - Apply mitigation on CVE-2023-48795

Description:

Description:

Testing Done:

Diff:

Testing Done:

Testing Done:

Change Summary:

Diff:

Status: Closed (submitted)