Vulnerability: Monotonically increasing version numbers not checked for increasing property (from Univ. of Iowa report) #268
Description
This vulnerability was highlighted in the University of Iowa report on Uptane's vulnerabilities.
Description
The idea of repositories using monotonically increasing version numbers is optional according to the Uptane Standard. However, disabling this feature will result in a degradation of the security advantages offered by Uptane. Additionally, the standard says
The payload differs depending on the role. However, the payload for all roles shares a common structure. It SHALL contain the following four attributes:
- An indicator of the type of role (Root, Targets, Snapshot, or Timestamp)
- An expiration date and time
- An integer version number, which SHOULD be incremented each time the metadata file is updated
- The role-specific metadata for the role indicated
The SHOULD recommends having an incrementing version number, but doesn't deem it necessary. As pointed out by the report, this has the potential for a specific kind of rollback attack. If a malicious actor replays an older Targets metadata file but this file doesn't have a lower version number then the version number check will pass. This is because Section 5.4.4.4 advises
Check that the version number of the previous Timestamp metadata file, if any, is less than or equal to the version number of this Timestamp metadata file.
Potential mitigations
This can potentially be fixed by tightening the requirements around the metadata version numbers:
- An integer version number, which
SHOULDSHALL be incremented each time the metadata file is updated - Check that the version number of the previous Timestamp metadata file, if any, is less than
or equal tothe version number of this Timestamp metadata file.
Please provide your thoughts on this below.