CVE-2020-17049

It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U), did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service principal allowed to delegate could use this flaw to impersonate a non-forwardable user.

As a prerequisite to be vulnerable, a Key Distribution Center (KDC) must be able to accept delegation via the Service for User (S4U) extensions.

Version of MIT Kerberos KDC in Red Hat Enterprise Linux (provided by the krb5-server package) only allows use of the S4U extensions when configured with an LDAP backend. Furthermore, delegations are denied by default and delegation rules must be explicitly created by an administrator, between a given service principal and its targets. Such a rule would entitle that service to use delegation to the targets. This means that, in order to exploit the flaw, an attacker would require either to trick an administrator into adding a rule for a malicious service principal, or have the knowledge of an entitled principal's secret key. The victim principals would be limited to the ones allowed by the rules for that service.

This CVE only affects systems supporting constrained delegation as defined by MS-SFU. Vanilla MIT krb5 realms do not support this protocol extension.

In Red Hat Enterprise Linux version 8 and older and Red Hat Gluster Storage, Samba as an Active Directory Domain Controller is not supported, and thus is not affected by this flaw.

RHEL Identity Management (RHEL IdM) implements constrained delegation feature using Active Directory's Kerberos extensions called Service for User (S4U). The constrained delegation implementation may potentially be vulnerable if an attacker is capable to create constrained delegation rules. In RHEL IdM only administrators allowed to add constrained delegation rules and only one such rule exists by default for HTTP/.. principal on IdM server. Security of IdM server is the key to safety of the whole RHEL IdM deployment. If an attacker is able to impersonate the HTTP/.. service principal on IdM server, they would be able to overtake the whole deployment even without a Kerberos protocol vulnerability described by CVE-2020-17049. However, if an attacker cannot control any service with pre-existing constrained delegation rules and cannot force creation of the constrained delegation rules for other Kerberos services, they cannot utilize CVE-2020-17049 vulnerability against RHEL IdM.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

In Red Hat Identity Management (IdM), the list of existing rules for service principals delegation can be obtained with the following commands : $ ipa servicedelegationrule-find $ ipa servicedelegationtarget-find The services allowed to delegate must all be trusted. By default, only HTTP/<IPA host>@<REALM>, corresponding to IdM's Web UI, is allowed to delegate.