The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0, disabling cloud-inits deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
Weakness
The product uses a hard-coded, unchangeable cryptographic key.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloud-init | Canonical | 0.6.2 (including) | 18.4 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | cloud-init-0:19.4-7.el7 | * |
| Red Hat Enterprise Linux 8 | RedHat | cloud-init-0:19.4-1.el8.7 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | cloud-init-0:18.5-12.el8_2.3 | * |
Potential Mitigations
References
- https://bugs.launchpad.net/cloud-init/+bug/1781094
- https://bugzilla.redhat.com/show_bug.cgi?id=1574338
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896
- https://bugs.launchpad.net/cloud-init/+bug/1781094
- https://bugzilla.redhat.com/show_bug.cgi?id=1574338
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896