Ubuntu
ecryptfs-utils package

ecryptfs may truncate encrypted passphrase store

Bug #1020902 reported by Chris Jones
262
This bug affects 2 people
Affects Status Importance Assigned to Milestone
ecryptfs-utils (Ubuntu)
Fix Released
High
Dustin Kirkland 

Bug Description

The following scenario leads to a zero byte encrypted passphrase store and therefore likely considerable dataloss:

* Disk runs out of space which causes weird login screen behaviour
* User changes their password with passwd(1) so they can hand the laptop to a support engineer and go to a meeting
* ecryptfs has somehow truncated the encrypted passphrase store and now it is impossible to complete ecryptfs-mount-private without the recorded key, which many users will not have

I would suggest that ecryptfs write out the encrypted passphrase to a new file and then move it in place, this should separate the act of writing from the act of replacing, so the first step will fail and at least the user will have the passphrase encrypted with their old password. This is sub-optimal, but easier to recover from than a truncated file!

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: ecryptfs-utils 96-0ubuntu3
ProcVersionSignature: Ubuntu 3.2.0-25.40-generic 3.2.18
Uname: Linux 3.2.0-25-generic i686
ApportVersion: 2.0.1-0ubuntu8
Architecture: i386
Date: Wed Jul 4 10:54:47 2012
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Release i386 (20110427.1)
ProcEnviron:
 LANGUAGE=en_GB:en
 TERM=xterm
 PATH=(custom, user)
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
SourcePackage: ecryptfs-utils
UpgradeStatus: Upgraded to precise on 2012-04-11 (83 days ago)

Revision history for this message
Chris Jones (cmsj) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ecryptfs-utils (Ubuntu):
status: New → Confirmed
Revision history for this message
Tyler Hicks (tyhicks) wrote :

Hi Chris - Sorry that you're affected by this bug.

Dustin - Can you please take a look at this? I'm currently behind on kernel maintenance.

Changed in ecryptfs-utils (Ubuntu):
assignee: nobody → Dustin Kirkland (kirkland)
importance: Undecided → High
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ecryptfs-utils - 104-0ubuntu1.14.10.3

---------------
ecryptfs-utils (104-0ubuntu1.14.10.3) utopic-security; urgency=medium

  * SECURITY UPDATE: Mount passphrase wrapped with a default salt value
    - debian/patches/CVE-2014-9687.patch: Generate a random salt when wrapping
      the mount passphrase. If a user has a mount passphrase that was wrapped
      using the default salt, their mount passphrase will be rewrapped using a
      random salt when they log in with their password.
    - debian/patches/CVE-2014-9687.patch: Create a temporary file when
      creating a new wrapped-passphrase file and copy it to its final
      destination after the file has been fully synced to disk (LP: #1020902)
    - debian/rules: Set the executable bit on the
      v1-to-v2-wrapped-passphrase.sh test script that was created by
      wrapping-passphrase-salt.patch
    - CVE-2014-9687
 -- Tyler Hicks <email address hidden> Wed, 04 Mar 2015 16:40:18 -0600

Changed in ecryptfs-utils (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ecryptfs-utils - 96-0ubuntu3.4

---------------
ecryptfs-utils (96-0ubuntu3.4) precise-security; urgency=medium

  * SECURITY UPDATE: Mount passphrase wrapped with a default salt value
    - debian/patches/CVE-2014-9687.patch: Generate a random salt when wrapping
      the mount passphrase. If a user has a mount passphrase that was wrapped
      using the default salt, their mount passphrase will be rewrapped using a
      random salt when they log in with their password.
    - debian/patches/CVE-2014-9687.patch: Create a temporary file when
      creating a new wrapped-passphrase file and copy it to its final
      destination after the file has been fully synced to disk (LP: #1020902)
    - debian/rules: Set the executable bit on the wrap-unwrap.sh and
      v1-to-v2-wrapped-passphrase.sh test scripts that were created by
      wrapping-passphrase-salt.patch
    - CVE-2014-9687
 -- Tyler Hicks <email address hidden> Wed, 04 Mar 2015 16:38:14 -0600

Changed in ecryptfs-utils (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ecryptfs-utils - 83-0ubuntu3.2.10.04.6

---------------
ecryptfs-utils (83-0ubuntu3.2.10.04.6) lucid-security; urgency=medium

  * SECURITY UPDATE: Mount passphrase wrapped with a default salt value
    - src/libecryptfs/key_management.c, src/include/ecryptfs.h: Generate a
      random salt when wrapping the mount passphrase.
    - src/pam_ecryptfs/pam_ecryptfs.c: If a user has a mount passphrase that was
      wrapped using the default salt, their mount passphrase will be rewrapped
      using a random salt when they log in with their password.
    - src/libecryptfs/key_management.c: Create a temporary file when creating
      a new wrapped-passphrase file and copy it to its final destination after
      the file has been fully synced to disk (LP: #1020902)
    - CVE-2014-9687
 -- Tyler Hicks <email address hidden> Wed, 04 Mar 2015 16:26:45 -0600

Changed in ecryptfs-utils (Ubuntu):
status: Confirmed → Fix Released
Mathew Hodson (mhodson)
information type: Public → Public Security
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.