CVE-2020-17049 (Moderate severity, published 2020-11-09)
CVSS score: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-345
Description: It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U), did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service principal allowed to delegate could use this flaw to impersonate a non-forwardable user.
Statement: As a prerequisite to be vulnerable, a Key Distribution Center (KDC) must be able to accept delegation via the `Service for User` (S4U) extensions.

Version of MIT Kerberos KDC in Red Hat Enterprise Linux (provided by the krb5-server package) only allows use of the S4U extensions when configured with an LDAP backend. Furthermore, delegations are denied by default and delegation rules must be explicitly created by an administrator, between a given service principal and its targets. Such a rule would entitle that service to use delegation to the targets.  This means that, in order to exploit the flaw, an attacker would require either to trick an administrator into adding a rule for a malicious service principal, or have the knowledge of an entitled principal's secret key. The victim principals would be limited to the ones allowed by the rules for that service.

This CVE only affects systems supporting constrained delegation as defined by MS-SFU. Vanilla MIT krb5 realms do not support this protocol extension.

In Red Hat Enterprise Linux version 8 and older and Red Hat Gluster Storage, Samba as an Active Directory Domain Controller is not supported, and thus is not affected by this flaw.

RHEL Identity Management (RHEL IdM) implements constrained delegation feature using Active Directory's Kerberos extensions called Service for User (S4U). The constrained delegation implementation may potentially be vulnerable if an attacker is capable to create constrained delegation rules. In RHEL IdM only administrators allowed to add constrained delegation rules and only one such rule exists by default for HTTP/..  principal on IdM server. Security of IdM server is the key to safety of the whole RHEL IdM deployment. If an attacker is able to impersonate the HTTP/.. service principal on IdM server, they would be able to overtake the whole deployment even without a Kerberos protocol vulnerability described by CVE-2020-17049. However, if an attacker cannot control any service with pre-existing constrained delegation rules and cannot force creation of the constrained delegation rules for other Kerberos services, they cannot utilize CVE-2020-17049 vulnerability against RHEL IdM.

Within regulated environments, a combination of the following controls acts as a significant barrier to the successful exploitation of a CWE-345: Insufficient Verification of Data Authenticity vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.

Red Hat restricts access to all information contained within the platform by default. Access to the platform is granted only after successful hard token, multi-factor authentication (MFA), which is coupled with least privilege principles to ensure that only authorized roles and users can execute or manipulate code. Event logs are collected and processed for centralization, correlation, analysis, monitoring, reporting, alerting, and retention. This process ensures that audit logs are generated for specific events involving sensitive information, ensuring that mechanisms such as digital signatures or certificates verify the authenticity and origin of data. External infrastructure and internal cluster certificates are established and maintained within the secure environment. The platform enforces validated cryptographic modules across all compute resources, helping prevent unauthorized actors from accessing or interpreting exposed information, even if it is intercepted.
Mitigation: In Red Hat Identity Management (IdM), the list of existing rules for service principals  delegation can be obtained with the following commands :
$ ipa servicedelegationrule-find
$ ipa servicedelegationtarget-find
The services allowed to delegate must all be trusted.
By default, only HTTP/<IPA host>@<REALM>, corresponding to IdM's Web UI, is allowed to delegate.