Описание
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
A flaw was found in etcd, a distributed key-value store. A remote attacker can exploit this by opening numerous TCP connections to an etcd TLS listener without completing the TLS handshake. This action causes the tlsListener.acceptLoop to spawn an unbounded number of goroutines, which consume excessive memory. This resource exhaustion leads to a Denial of Service (DoS) for the etcd cluster and, consequently, for the Kubernetes control plane it supports.
Отчет
This is an Important denial of service flaw in etcd, a critical component for distributed systems and Kubernetes control planes. A remote attacker can exhaust etcd memory by initiating numerous incomplete TLS handshakes, leading to a loss of availability for affected clusters.
Меры по смягчению последствий
Restrict network access to the etcd TLS listener to only trusted clients and networks. Configure firewall rules to limit inbound connections to the etcd client port (default 2379) and peer port (default 2380) to authorized hosts. This reduces the attack surface by preventing untrusted network attackers from reaching the vulnerable service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/observatorium-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform/platform-operator-bundle | Not affected | ||
| Red Hat Ceph Storage 5 | rhceph/snmp-notifier-rhel8 | Affected | ||
| Red Hat Ceph Storage 6 | rhceph/rhceph-promtail-rhel9 | Affected | ||
| Red Hat Ceph Storage 6 | rhceph/snmp-notifier-rhel9 | Affected | ||
| Red Hat Ceph Storage 7 | rhceph/snmp-notifier-rhel9 | Affected | ||
| Red Hat Ceph Storage 8 | rhceph/snmp-notifier-rhel9 | Affected | ||
| Red Hat Ceph Storage 9 | rhceph/snmp-notifier-rhel10 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/oc-mirror-plugin-rhel9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
etcd is a distributed key-value store for the data of a distributed sy ...
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
EPSS
7.5 High
CVSS3