[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150613093351.GF11230@mail.waldi.eu.org>
Date: Sat, 13 Jun 2015 11:33:51 +0200
From: Bastian Blank <waldi@...ian.org>
To: oss-security@...ts.openwall.com
Subject: PostgreSQL - Predictable cancel key
Hi
PostgreSQL postmaster uses predictable random numbers from random().
The PRNG is seeded once during its lifetime with srandom(). The seed is
generated as following, also zero is explicitely excluded:
| random_seed = random_start_time.tv_usec ^
| ((random_stop_time.tv_usec << 16) |
| ((random_stop_time.tv_usec >> 16) & 0xffff));
So we have at most 1,000,000 different seeds.
A so called cancel key is generated with random() for every new backend
used by client connections and for autovacuum childs. This key together
with the PID is used for asynchronous cancelation of queries in client
backends. This values are transmitted to the client after successful
authentication.
The information needed to cancel other queries is the (sequential, at
least on Linux) pid and a predicable (secret) key.
Another set of four calles to random() are used to generate the salt for
the md5-authentication. This value is given to the client before the
authentication. One call per byte is done, excluding zero bytes:
| md5Salt[0] = (random() % 255) + 1;
| md5Salt[1] = (random() % 255) + 1;
| md5Salt[2] = (random() % 255) + 1;
| md5Salt[3] = (random() % 255) + 1;
Timeline:
- 2015-02-13: Reported upstream, considered no problem
- 2015-06-13: Published
Regards,
Bastian
--
A princess should not be afraid -- not with a brave knight to protect her.
-- McCoy, "Shore Leave", stardate 3025.3
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
