$ the-wire · showcase
Consul patches six security vulnerabilities, including pre-auth RPC memory exhaustion
By RepoJournal · Filed · About HashiCorp
Consul shipped a coordinated set of security fixes addressing five vulnerabilities, including a pre-auth memory exhaustion vector and an ACL bypass allowing cross-node takeover.
Consul released a coordinated set of security fixes. An mTLS-authenticated client with no ACL token could exhaust server memory before authorization by crafting a MessagePack str32 header with a large declared string length, since the decoder allocated the byte slice before method lookup, rate limiting, or ACL evaluation. RPC header size is now bounded. [1] Additionally, a local ACL token with service:write or node:write could delete peer-imported catalog objects by supplying a non-default PeerName in a Catalog.Deregister request, as authorization was checked only against the local object name. Non-default PeerName is now rejected. [2]
The fixes also close a catalog node-ID ACL bypass. vetRegisterWithACL checked ACLs only against the node name in the request, but ensureNodeTxn resolves by Node.ID first; if names differ it could cascade-delete the victim node and its services, enabling cross-node takeover. Now a write on the existing node is required when the request carries a foreign Node.ID. [3] Additionally, SPIFFE RBAC patterns now escape regex metacharacters to prevent intention bypass [4], and Lua/Wasm extensions and bootstrap escape-hatch keys are now gated behind mesh:write. [5]
In the dataplane, consul-dataplane bumped google.golang.org/grpc to v1.83.2, which fixes GHSA-vp52-pcj8-j9qc. That advisory describes an unauthenticated remote attacker fragmenting a gRPC stream payload into millions of tiny HTTP/2 DATA frames to inflate memory overhead and cause an OOM/DoS. This is a breaking change only in that the dependency version moves to a patched release. [6]
Separately, consul-k8s removed root-group membership in the UBI-based image, a hardening change that reduces the container's privileges. [7] And Consul Enterprise, along with consul-k8s, consul-dataplane, and consul-ecs, migrated FIPS builds from FIPS 140-2 (BoringCrypto and CNG cgo toolchains) to FIPS 140-3 using the Go Cryptographic Module (GOFIPS140=v1.0.0); target versions are v1.21.x, v1.22.x, and v2.0.x, while v1.16.x through v1.20.x remain on FIPS 140-2. The documentation now reflects this behavior. [8]
Action items
- → Upgrade Consul servers and agents to a patched release before your next production deploy to close the five security vulnerabilities. hashicorp/consul [immediate]
- → Upgrade consul-dataplane to a release that includes grpc v1.83.2 to mitigate the HTTP/2 frame memory exhaustion DoS. hashicorp/consul-dataplane [immediate]
- → When moving to Consul v1.21.x, v1.22.x, or v2.0.x, plan for the FIPS 140-3 migration and verify your cryptographic configurations. hashicorp/web-unified-docs [plan]
- → Review your UBI-based consul-k8s deployment for any reliance on root-group membership, now removed. hashicorp/consul-k8s [monitor]
References
- [1] security: bound RPC header size to prevent pre-auth memory exhaustion (#23898) ↗ hashicorp/consul
- [2] security: reject non-default PeerName in Catalog.Deregister (#23897) ↗ hashicorp/consul
- [3] security: fix catalog node-ID ACL bypass allowing cross-node takeover (#23899) ↗ hashicorp/consul
- [4] security: escape regex metacharacters in SPIFFE RBAC patterns (#23900) ↗ hashicorp/consul
- [5] security: gate Lua/Wasm extensions and bootstrap escape-hatch keys behind mesh:write (#23901) ↗ hashicorp/consul
- [6] Bump google.golang.org/grpc to v1.83.2 to fix GHSA-vp52-pcj8-j9qc (#1271) ↗ hashicorp/consul-dataplane
- [7] remove root-group membership in ubi based image (#5640) ↗ hashicorp/consul-k8s
- [8] Consul Docs: update FIPS documentation for the 140-3 migration ↗ hashicorp/web-unified-docs
