CVE ID: CVE-2022-31231
심각도: 중간
누가 이 절차를 실행해야 합니까?
Dell은 고객이 이 xDoctor를 업그레이드하는 절차와 패치 설치를 수행하도록 요청합니다. 이 방법은 취약성에 대한 장기간 노출을 피하기 때문에 가장 빠르고 안전한 방법입니다. 모든 단계는 이 KB에 자세히 설명되어 있습니다. 아래 링크에서 이 KB와 함께 제공되는 비디오 가이드도 제공됩니다.
절차의 영향:
Dataheadsvc 서비스가 노드별로 재시작되는 동안 I/O 시간 초과가 발생할 수 있습니다. 애플리케이션은 로드 밸런서를 통해 클러스터에 액세스해야 하며 I/O 시간 초과를 처리할 수 있어야 합니다. 이 절차를 수행할 때는 유지 보수 기간을 설정하는 것이 좋습니다.
CAS 전용 버킷 예외:
ECS의 모든 버킷이 아래에 CAS만 강조 표시된 경우 이 보안 취약성의 영향을 받지 않습니다. 따라서 패치를 적용할 필요가 없으며 이 KB를 따를 필요가 없습니다.
명령:
# svc_bucket list
예:
admin@ecs-n1:~> svc_bucket list
svc_bucket v1.0.33 (svc_tools v2.5.1) Started 2022-07-08 08:49:11
Bucket Temp
Replication Owner Owner API FS Versioning Failed
Bucket Name Namespace Group User VDC Type Enabled Enabled (TSO)
cas_bucket region_ns RG1 casuser VDC1 CAS false Disabled False
cas_bu region_ns RG1 cas_obj VDC1 CAS false Disabled False
test region_ns RG1 test1 VDC1 CAS false Disabled False
test_cas region_ns RG1 test_cas VDC1 CAS false Disabled False
test_bkt_cas region_ns RG1 user_test VDC1 CAS false Disabled False
Friday_cas region_ns RG1 Friday_cas VDC1 CAS false Disabled False
활동에 소요된 대략적인 시간:
서비스 재시작 사이에 노드별로 약 60초의 지연 시간이 기본적으로 설정됩니다. VDC(Virtual Data Center)의 노드 수에 60초 + 준비, 서비스 안정화 및 사후 검사가 필요한 데 30분을 곱한 값입니다.
예:
48노드 VDC ECS는 약 80분:
60초 X 48(VDC 노드 수) + 30분(준비) = 약 80분이 소요될 수 있습니다.
8노드 VDC ECS는 약 40분이 소요될 수 있습니다.
60초 X 8(VDC 노드 수) + 30분(준비) = 약 40분FAQ(Frequently Asked Question):
큐: 패치 부분은 xDoctor 릴리스의 일부입니까?
A: 패치 설치 스크립트는 xDoctor 릴리스 4.8-84 이상의 일부분입니다. xDoctor 다운로드 및 패치 설치 실행에 대한 지침은 해결 단계에 있습니다.
Q: 여러 VDC를 동시에 업데이트할 수 있습니까?
A: 아니요. 한 번에 하나의 VDC를 패치합니다.
Q: 이 절차를 실행한 후 ECS를 업그레이드할 경우 업그레이드 후 절차를 다시 실행해야 합니까?
A: 아니요.영구 수정 사항이 있는 DSA-2022-153에 지정된 코드 버전으로 업그레이드하는 경우 그렇지 않습니다. 예. 이 동일한 DSA에 지정되지 않은 코드 버전으로 업그레이드할 경우 그렇습니다.
Q: 노드 교체, 이미지 재작성 또는 확장 후 패치가 이전에 설치된 ECS에 패치를 다시 적용해야 합니까?
ᅡ: 아니요. VDC가 영구 수정 사항이 있는 DSA-2022-153에 지정된 코드 버전인 경우 그렇지 않습니다. 예. 이 동일한 DSA에 지정되지 않은 코드 버전을 실행하는 VDC에 대해 이러한 작업을 수행하는 경우 그렇습니다. 이러한 시나리오에 패치가 필요한 경우 해당 Dell 엔지니어가 업데이트해야 함을 알리기 위해 연락을 드릴 것입니다.
큐: IAM을 사용하지 않고 기존 사용자만 사용하는 경우 어떻게 해야 합니까?
ᅡ: 고객은 IAM이 아닌 레거시 사용자만 사용하는 경우 패치를 적용해야 합니다.
큐: 이 KB의 모든 명령을 실행하려면 어떤 사용자로 로그인해야 합니까?
A: 관리자
질문: svc_patch를 모든 랙에서 실행해야 합니까, 아니면 여러 랙이 VDC에 있는 특수 MACHINES 파일을 사용해야 합니까?
A: 아니요. 여러 랙이 있는 경우 자동으로 감지하여 해당 VDC의 모든 랙에 있는 모든 노드를 업데이트합니다.
큐: 타겟 xDoctor 릴리스가 더 이상 4.8-84.0이 아닙니다. 그 이유는 무엇입니까?
A:xDoctor 릴리스는 자주 출시되므로 항상 가장 높은 릴리스 버전으로 업그레이드하는 것이 좋습니다. 그러나 이전에 4.8-84.0을 사용하여 수정 사항을 실행한 경우 ECS는 취약성으로부터 완전히 보호되므로 다시 실행할 필요가 없습니다.
해결 방법 요약:
ECS xDoctor 소프트웨어를 최신 버전으로 업그레이드하십시오.
# sudo xdoctor --version
admin@node1:~> sudo xdoctor --version 4.8-84.0
# sudo xdoctor --upgrade --local=/home/admin/xDoctor4ECS-4.8-84.0.noarch.rpm
admin@ecs-n1:~> sudo xdoctor --upgrade --local=/home/admin/xDoctor4ECS-4.8-84.0.noarch.rpm 2022-07-04 07:41:49,209: xDoctor_4.8-83.0 - INFO : xDoctor Upgrader Instance (1:SFTP_ONLY) 2022-07-04 07:41:49,210: xDoctor_4.8-83.0 - INFO : Local Upgrade (/home/admin/xDoctor4ECS-4.8-84.0.noarch.rpm) 2022-07-04 07:41:49,226: xDoctor_4.8-83.0 - INFO : Current Installed xDoctor version is 4.8-83.0 2022-07-04 07:41:49,242: xDoctor_4.8-83.0 - INFO : Requested package version is 4.8-84.0 2022-07-04 07:41:49,242: xDoctor_4.8-83.0 - INFO : Updating xDoctor RPM Package (RPM) 2022-07-04 07:41:49,293: xDoctor_4.8-83.0 - INFO : - Distribute package 2022-07-04 07:41:50,759: xDoctor_4.8-83.0 - INFO : - Install new rpm package 2022-07-04 07:42:04,401: xDoctor_4.8-83.0 - INFO : xDoctor successfully updated to version 4.8-84.0
# svc_exec -m "ip address show private.4 |grep -w inet"
admin@ecsnode1~> svc_exec -m "ip address show private.4 |grep -w inet" svc_exec v1.0.2 (svc_tools v2.1.0) Started 2021-12-20 14:03:33 Output from node: r1n1 retval: 0 inet 169.254.1.1/16 brd 169.254.255.255 scope global private.4 Output from node: r2n1 retval: 0 inet 169.254.2.1/16 brd 169.254.255.255 scope global private.4 Output from node: r3n1 retval: 0 inet 169.254.3.1/16 brd 169.254.255.255 scope global private.4 Output from node: r4n1 retval: 0 inet 169.254.4.1/16 brd 169.254.255.255 scope global private.4
admin@ecs-n1: scp xDoctor4ECS-4.8-84.0.noarch.rpm 169.254.2.1:/home/admin/ xDoctor4ECS-4.8-84.0.noarch.rpm 100% 32MB 31.9MB/s 00:00 admin@ecsnode1~> scp xDoctor4ECS-4.8-84.0.noarch.rpm 169.254.3.1:/home/admin/ xDoctor4ECS-4.8-84.0.noarch.rpm 100% 32MB 31.9MB/s 00:00 admin@ecsnode1~> scp xDoctor4ECS-4.8-784.0.noarch.rpm 169.254.4.1:/home/admin/ xDoctor4ECS-4.8-84.0.noarch.rpm 100% 32MB 31.9MB/s 00:00 admin@ecsnode1~>
# sudo xdoctor --upgrade --local=/home/admin/xDoctor4ECS-4.8-84.0.noarch.rpm
# svc_dt check -b
admin@ecs-n1: svc_dt check -b svc_dt v1.0.27 (svc_tools v2.4.1) Started 2022-06-14 11:34:26 Date Total DT Unknown # Unready # RIS Fail # Dump Fail # Check type Time since check Check successful 2022-06-14 11:34:09 1920 0 0 0 0 AutoCheck 0m 17s True 2022-06-14 11:32:59 1920 0 0 0 0 AutoCheck 1m 27s True 2022-06-14 11:31:48 1920 0 0 0 0 AutoCheck 2m 38s True 2022-06-14 11:30:38 1920 0 0 0 0 AutoCheck 3m 48s True 2022-06-14 11:29:28 1920 0 0 0 0 AutoCheck 4m 58s True 2022-06-14 11:28:18 1920 0 0 0 0 AutoCheck 6m 8s True 2022-06-14 11:27:07 1920 0 0 0 0 AutoCheck 7m 19s True 2022-06-14 11:25:57 1920 0 0 0 0 AutoCheck 8m 29s True 2022-06-14 11:24:47 1920 0 0 0 0 AutoCheck 9m 39s True 2022-06-14 11:23:37 1920 0 0 0 0 AutoCheck 10m 49s True
# /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status
admin@ecs-n1:~> /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status
svc_patch Version 2.9.2
Verifying patch bundle consistency DONE
Detecting nodes in current VDC DONE
Reading in patch details (1 of 2) DONE
Reading in patch details (2 of 2) DONE
Validating nodes are online DONE
Checking Installed Patches and Dependencies DONE
Patches/releases currently installed:
n/a (Base release)
Patches that need to be installed:
CVE-2022-31231_iam-fix (PatchID: 3525)
Files that need to be installed:
/opt/storageos/conf/iam.object.properties (from CVE-2022-31231_iam-fix)
/opt/storageos/lib/storageos-iam.jar (from CVE-2022-31231_iam-fix)
The following services need to be restarted:
dataheadsvc
# screen -S patchinstall # unset TMOUT # /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch install
admin@ecs-n1:~> screen -S patchinstall
admin@ecs-n1:~> unset TMOUT
admin@ecs-n1:~> /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch install
svc_patch Version 2.9.2
Verifying patch bundle consistency DONE
Detecting nodes in current VDC DONE
Reading in patch details (1 of 2) DONE
Reading in patch details (2 of 2) DONE
Validating nodes are online DONE
Checking Installed Patches and Dependencies DONE
Patches/releases currently installed:
n/a (Base release)
Patches that will be installed:
CVE-2022-31231_iam-fix (PatchID: 3525)
Files that will be installed:
/opt/storageos/conf/iam.object.properties (from CVE-2022-31231_iam-fix)
/opt/storageos/lib/storageos-iam.jar (from CVE-2022-31231_iam-fix)
The following services will be restarted:
dataheadsvc
Patch Type: Standalone
Number of nodes: 5
Number of seconds to wait between restarting node services: 60
Check DT status between node service restarts: false
Do you wish to continue (y/n)?y
Distributing files to node 169.254.1.1
Distributing patch installer to node '169.254.1.1'
Distributing files to node 169.254.1.2
Distributing patch installer to node '169.254.1.2'
Distributing files to node 169.254.1.3
Distributing patch installer to node '169.254.1.3'
Distributing files to node 169.254.1.4
Distributing patch installer to node '169.254.1.4'
Distributing files to node 169.254.1.5
Distributing patch installer to node '169.254.1.5'
Restarting services on 169.254.1.1
Restarting dataheadsvc
Waiting 60 seconds for services to stabilize...DONE
Restarting services on 169.254.1.2
Restarting dataheadsvc
Waiting 60 seconds for services to stabilize...DONE
Restarting services on 169.254.1.3
Restarting dataheadsvc
Waiting 60 seconds for services to stabilize...DONE
Restarting services on 169.254.1.4
Restarting dataheadsvc
Waiting 60 seconds for services to stabilize...DONE
Restarting services on 169.254.1.5
Restarting dataheadsvc
Waiting 60 seconds for services to stabilize...DONE
Patching complete.
admin@node1:/> exit logout [screen is terminating] admin@node1:/>
admin@node 1:~> screen -ls There is a screen on: 113275.pts-0.ecs-n3 (Detached) 1 Socket in /var/run/uscreens/S-admin.
admin@node1:~> screen -r 113277.pts-0.ecs-n3
# /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status
admin@ecs-n1:~> /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status
svc_patch Version 2.9.2
Verifying patch bundle consistency DONE
Detecting nodes in current VDC DONE
Reading in patch details (1 of 2) DONE
Reading in patch details (2 of 2) DONE
Validating nodes are online DONE
Checking Installed Patches and Dependencies DONE
Patches/releases currently installed:
CVE-2022-31231_iam-fix (PatchID: 3525) Fix for ECS iam vulnerability CVE-2022-31231
n/a (Base release)
Patches that need to be installed:
No files need to be installed.
The following services need to be restarted:
No services need to be restarted.
admin@ecs-n1:~> /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status
svc_patch Version 2.9.2
Verifying patch bundle consistency DONE
Detecting nodes in current VDC DONE
Reading in patch details (1 of 2) DONE
Reading in patch details (2 of 2) DONE
Validating nodes are online DONE
Checking Installed Patches and Dependencies DONE
Patches/releases currently installed:
n/a (Base release)
Patches that need to be installed:
CVE-2022-31231_iam-fix (PatchID: 3525)
Files that need to be installed:
/opt/storageos/conf/iam.object.properties (from CVE-2022-31231_iam-fix)
/opt/storageos/lib/storageos-iam.jar (from CVE-2022-31231_iam-fix)
The following services need to be restarted:
dataheadsvc
admin@ecs-n1 /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status
svc_patch Version 2.9.2
Verifying patch bundle consistency DONE
Detecting nodes in current VDC DONE
Reading in patch details (1 of 2) DONE
Reading in patch details (2 of 2) DONE
Validating nodes are online DONE
Checking Installed Patches and Dependencies FAILED
Fatal: Currently installed version of storageos-iam.jar is unknown.
This likely means that a custom Isolated Patch is installed.
Please contact your next level of support for further steps, and
include this information
Detected md5sum: 6ec26421d426365ecb2a63d8e0f8ee4f
svc_patch Version 2.9.2 Verifying patch bundle consistency DONE Detecting nodes in current VDC DONE Reading in patch details (1 of 2) DONE Reading in patch details (2 of 2) DONE Validating nodes are online FAILED ERROR: Could not execute commands on the object-main container on 169.254.x.x Output was 'Failed to add the host to the list of known hosts (/home/admin/.ssh/known_hosts). :patchtest:' Patching is unable to continue with unreachable nodes. To proceed: - Resolve problems accessing node(s) from this one. - Manually pass a MACHINES file containing the list of working nodes to patch (not recommended). - Contact your next level of support for other options or assistance.
admin@node1:~> ls -l /home/admin/.ssh/known_hosts -rw------- 1 root root 1802 Jul 23 2019 /home/admin/.ssh/known_hosts admin@ecs:~>
# sudo chown admin:users /home/admin/.ssh/known_hosts
admin@node1:~> sudo chown admin:users /home/admin/.ssh/known_hosts
admin@node1:~> /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch install
svc_patch Version 2.9.2 Verifying patch bundle consistency DONE Detecting nodes in current VDC DONE Reading in patch details (1 of 2) DONE Reading in patch details (2 of 2) DONE Validating nodes are online FAILED ERROR: Could not execute commands on the object-main container on 169.254.x.x Output was '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256:RcwOsFj7zPA5p5kSeYovF4UlZTm125nLVeCL1zCqOzc. Please contact your system administrator. Add correct host key in /home/admin/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /home/admin/.ssh/known_hosts:14 You can use following command to remove the offending key: ssh-keygen -R 169.254.x.x -f /home/admin/.ssh/known_hosts Password authentication is disabled to avoid man-in-the-middle attacks. Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks. :patchtest:' Patching is unable to continue with unreachable nodes. To proceed: - Resolve problems accessing node(s) from this one. - Manually pass a MACHINES file containing the list of working nodes to patch (not recommended). - Contact your next level of support for other options or assistance.
# /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/svc_patch status svc_patch Version 2.9.3 Verifying patch bundle consistency FAILED Patch bundle consistency check failed - md5sums for one or more files in the patch bundle were invalid, or files were not found. svc_patch will attempt to validate files in the patch using MD5SUMS.bundle, which is bundled with the patch. Output from md5sum was: ./lib/libs/svc_base.py: FAILED md5sum: WARNING: 1 computed checksum did NOT match
# sudo sed -i '/svc_base.py/d' /opt/emc/xdoctor/patches/CVE-2022-31231_iam-fix/MD5SUMS.bundle # sudo sed -i '/MD5SUMS.bundle/d' /opt/emc/xdoctor/.xdr_chksum