Privilege Escalation

openstack keystone is vulnerable to privilege escalation. The library does not properly enforce the role parameters associated to an OAuth1 access token. A keystone token containing every role assignment is assigned to a low-privileged user, granting the user more access than required...

RHEL 7 : openstack-keystone (RHSA-2020:2732)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2732 advisory. The OpenStack Identity service keystone authenticates and authorizes OpenStack users by keeping track of users and their permitted activitie...

SGN - Encoder Ported Into Go With Several Improvements

SGN is a polymorphic binary encoder for offensive security purposes such as generating statically undetecable binary payloads. It uses a additive feedback loop to encode given binary instructions similar to LSFR. This project is the reimplementation of the original Shikata ga nai in golang with...

keystone:fuzz_asm_arm_armbe: Use-of-uninitialized-value in llvm_ks::ARMAsmBackend::adjustFixupValue

Detailed Report: https://oss-fuzz.com/testcase?key=5712919152295936 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmarmarmbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::ARMAsmBackend::adjustFixupValu...

keystone:fuzz_asm_x86_64: Use-of-uninitialized-value in llvm_ks::isIntN

Detailed Report: https://oss-fuzz.com/testcase?key=6316147845890048 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8664 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::isIntN X86AsmBackend::applyFixup...

keystone:fuzz_asm_arm_thumbbe: Use-of-uninitialized-value in llvm_ks::ARMAsmBackend::reasonForFixupRelaxation

Detailed Report: https://oss-fuzz.com/testcase?key=5454398435360768 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmarmthumbbe Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

keystone:fuzz_asm_x86_16: Heap-use-after-free in llvm_ks::X86Operand::getToken

Detailed Report: https://oss-fuzz.com/testcase?key=5637154293415936 Project: keystone Fuzzing Engine: afl Fuzz Target: fuzzasmx8616 Job Type: aflasankeystone Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60d000000a28 Crash State: llvmks::X86Operand::getToken...

keystone:fuzz_asm_mips64be: Use-of-uninitialized-value in MipsAsmParser::isPicAndNotNxxAbi

Detailed Report: https://oss-fuzz.com/testcase?key=5663481503416320 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmmips64be Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: MipsAsmParser::isPicAndNotNxxAbi...

keystone:fuzz_asm_hex: Use-of-uninitialized-value in llvm_ks::HexagonMCCodeEmitter::getExprOpValue

Detailed Report: https://oss-fuzz.com/testcase?key=6220669925982208 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmhex Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::HexagonMCCodeEmitter::getExprOpValu...

keystone:fuzz_asm_mips64: Use-of-uninitialized-value in MipsAsmParser::processInstruction

Detailed Report: https://oss-fuzz.com/testcase?key=6308839044677632 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmmips64 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: MipsAsmParser::processInstruction...

keystone:fuzz_asm_x86_64: Use-of-uninitialized-value in X86AsmParser::ParseIntelOperand

Detailed Report: https://oss-fuzz.com/testcase?key=5087523687890944 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8664 Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: X86AsmParser::ParseIntelOperand...

keystone:fuzz_asm_arm_arm: Use-of-uninitialized-value in llvm_ks::MCAssembler::computeFragmentSize

Detailed Report: https://oss-fuzz.com/testcase?key=5659471866232832 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmarmarm Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::MCAssembler::computeFragmentSize...

keystone:fuzz_asm_arm_arm: Use-of-uninitialized-value in llvm_ks::MCAssembler::computeFragmentSize

Detailed Report: https://oss-fuzz.com/testcase?key=5675616111427584 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmarmarm Job Type: libfuzzermsankeystone Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: llvmks::MCAssembler::computeFragmentSize...

keystone:fuzz_asm_sparc64be: Invalid-free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl

Detailed Report: https://oss-fuzz.com/testcase?key=5767140656545792 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmsparc64be Job Type: libfuzzerasankeystone Platform Id: linux Crash Type: Invalid-free Crash Address: 0x61900000059d Crash State:...

keystone:fuzz_asm_x86_64: Bad-cast to const llvm_ks::MCSectionELF from llvm_ks::MCSectionMachO in llvm_ks::MCELFStreamer::ChangeSection

Detailed Report: https://oss-fuzz.com/testcase?key=5733234540544000 Project: keystone Fuzzing Engine: libFuzzer Fuzz Target: fuzzasmx8664 Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000002a51160 Crash State: Bad-cast to const llvmks::MCSectionELF from...

keystone:fuzz_asm_sparc64be: Crash in llvm_ks::MCEncodedFragmentWithFixups<32u, 4u>::~MCEncodedFragmentWithFixups

Project: https://github.com/keystone-engine/keystone.git Detailed Report: https://oss-fuzz.com/testcase?key=5669285766889472 Project: keystone Fuzzing Engine: afl Fuzz Target: fuzzasmsparc64be Job Type: aflasankeystone Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x6190000364d2 Cra...

Privilege Escalation

keystone is vulnerable to privilege escalation. The vulnerability exists as an authenticated user is able to masquerade as another higher privileged user by updating the credential user and project, potentially obtaining administrative privileges...

Privilege Escalation

openstack keystone is vulnerable to privilege escalation. A low-privileged user with a limited role is able to authenticate against Keystone using an EC2 credentials to obtain all project roles of a trust/oauth/applicationcredential owner...

Man-in-the-Middle (MitM)

openstack keystone is vulnerable to man-in-the-middle attack. Lack of signature TTL check to verify the timestamp in the AWS Signature V4 token signature allows an attacker to sniff an Authorization header in a man-in-the-middle attack and reuse the header to reissue openstack tokens...

CVE-2020-12692

A flaw was found in Keystone, where the restriction was not checked for the Signature Version 4 V4 process of AWS signatures issued within a limited time window. This flaw allows an attacker to capture an auth header and reuse it, potentially maintaining indefinite access...