Executive brief
OpenStack Keystone is an identity and authentication service used to manage user credentials and access control across cloud infrastructure. When configured with memcache as its token storage backend and trust tokens with impersonation are enabled, revoked tokens may not be properly invalidated, allowing privileged users to retain unauthorized access longer than intended.
Technical details
The memcache token backend in OpenStack Keystone fails to add impersonated trust tokens to the trustee's token-index-list, a data structure used to track active tokens for bulk revocation. This is a token management logic flaw (CWE-1270, CWE-287) affecting versions 2013.1 through 2013.1.4, 2013.2 through 2013.2.2, and early icehouse releases. An authenticated trustee with an impersonation-enabled trust can bypass token revocation by leveraging tokens that remain in the memcache store despite revocation requests. Network access to Keystone and valid trustee credentials are required. The vulnerability was fixed in Keystone 8.0.0a0 and earlier patch releases for older branches.
Affected products
- OpenStack Keystone 2013.1 through 2013.1.4, 2013.2 through 2013.2.2, icehouse before icehouse-3
Timeline
- 2014-04-01: disclosed
- 2014: patched: Fixed in Keystone 8.0.0a0 and earlier branch patches
- 2022-05-17: advisory: GitHub advisory GHSA-23x9-8hxr-978c published