[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+q1=fSKUpSWOGusA99-_KkBZOxqjUzVZFSOQECgjAP+QMzuig@mail.gmail.com>
Date: Thu, 1 Sep 2016 16:17:52 -0700
From: Diogo Mónica <diogo.monica@...ker.com>
To: oss-security@...ts.openwall.com
Subject: Re: cve request: docker swarmkit Dos occurs by repeatly joining and
quitting swam cluster as a node
A few weeks ago (Aug 4, 2016), a CVE (CVE-2016-6595) describing a DoS on
docker swarm got issued. We believe this not a real issue, and would like
to have the CVE rescinded.
The person reporting this "vulnerability" is exhausting the resources of a
remote manager by doing hundreds of join/leave operations without removing
the state that is left by old nodes. At some point the manager obviously
stops being able to accept new nodes, since it runs out of memory.
Given that both for Docker swarm and for Docker Swarmkit nodes are
*required* to provide a secret token (it's actually the only mode of
operation), this means that no adversary can simply join nodes and exhaust
manager resources.
We can't do anything about a manager running out of memory and not being
able to add new legitimate nodes to the system. This is merely a resource
provisioning issue, and definitely not a CVE worthy vulnerability.
Thank you,
--
Diogo Mónica
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
