| 1 |
From d3b6dfd70db844c4499bec6ad6601623a565e674 Mon Sep 17 00:00:00 2001 |
| 2 |
From: Tomas Mraz <tomas@openssl.org> |
| 3 |
Date: Wed, 18 Jan 2023 09:27:53 +0100 |
| 4 |
Subject: [PATCH 15/18] pk7_doit.c: Check return of BIO_set_md() calls |
| 5 |
|
| 6 |
These calls invoke EVP_DigestInit() which can fail for digests |
| 7 |
with implicit fetches. Subsequent EVP_DigestUpdate() from BIO_write() |
| 8 |
or EVP_DigestFinal() from BIO_read() will segfault on NULL |
| 9 |
dereference. This can be triggered by an attacker providing |
| 10 |
PKCS7 data digested with MD4 for example if the legacy provider |
| 11 |
is not loaded. |
| 12 |
|
| 13 |
If BIO_set_md() fails the md BIO cannot be used. |
| 14 |
|
| 15 |
CVE-2023-0401 |
| 16 |
|
| 17 |
Reviewed-by: Paul Dale <pauli@openssl.org> |
| 18 |
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> |
| 19 |
--- |
| 20 |
crypto/pkcs7/pk7_doit.c | 12 ++++++++++-- |
| 21 |
1 file changed, 10 insertions(+), 2 deletions(-) |
| 22 |
|
| 23 |
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c |
| 24 |
index bde9ac4787..5e562fbea5 100644 |
| 25 |
--- a/crypto/pkcs7/pk7_doit.c |
| 26 |
+++ b/crypto/pkcs7/pk7_doit.c |
| 27 |
@@ -84,7 +84,11 @@ static int pkcs7_bio_add_digest(BIO **pbio, X509_ALGOR *alg, |
| 28 |
} |
| 29 |
(void)ERR_pop_to_mark(); |
| 30 |
|
| 31 |
- BIO_set_md(btmp, md); |
| 32 |
+ if (BIO_set_md(btmp, md) <= 0) { |
| 33 |
+ ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB); |
| 34 |
+ EVP_MD_free(fetched); |
| 35 |
+ goto err; |
| 36 |
+ } |
| 37 |
EVP_MD_free(fetched); |
| 38 |
if (*pbio == NULL) |
| 39 |
*pbio = btmp; |
| 40 |
@@ -522,7 +526,11 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) |
| 41 |
} |
| 42 |
(void)ERR_pop_to_mark(); |
| 43 |
|
| 44 |
- BIO_set_md(btmp, md); |
| 45 |
+ if (BIO_set_md(btmp, md) <= 0) { |
| 46 |
+ EVP_MD_free(evp_md); |
| 47 |
+ ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB); |
| 48 |
+ goto err; |
| 49 |
+ } |
| 50 |
EVP_MD_free(evp_md); |
| 51 |
if (out == NULL) |
| 52 |
out = btmp; |
| 53 |
-- |
| 54 |
2.39.1 |
| 55 |
|
| 56 |
From a0f2359613f50b5ca6b74b78bf4b54d7dc925fd2 Mon Sep 17 00:00:00 2001 |
| 57 |
From: Tomas Mraz <tomas@openssl.org> |
| 58 |
Date: Wed, 18 Jan 2023 17:07:24 +0100 |
| 59 |
Subject: [PATCH 16/18] Add testcase for missing return check of BIO_set_md() |
| 60 |
calls |
| 61 |
|
| 62 |
Reviewed-by: Paul Dale <pauli@openssl.org> |
| 63 |
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> |
| 64 |
--- |
| 65 |
test/recipes/80-test_cms.t | 15 ++++++++-- |
| 66 |
test/recipes/80-test_cms_data/pkcs7-md4.pem | 32 +++++++++++++++++++++ |
| 67 |
2 files changed, 45 insertions(+), 2 deletions(-) |
| 68 |
create mode 100644 test/recipes/80-test_cms_data/pkcs7-md4.pem |
| 69 |
|
| 70 |
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t |
| 71 |
index fd53683e6b..d45789de70 100644 |
| 72 |
--- a/test/recipes/80-test_cms.t |
| 73 |
+++ b/test/recipes/80-test_cms.t |
| 74 |
@@ -13,7 +13,7 @@ use warnings; |
| 75 |
use POSIX; |
| 76 |
use File::Spec::Functions qw/catfile/; |
| 77 |
use File::Compare qw/compare_text compare/; |
| 78 |
-use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file with/; |
| 79 |
+use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file with data_file/; |
| 80 |
|
| 81 |
use OpenSSL::Test::Utils; |
| 82 |
|
| 83 |
@@ -50,7 +50,7 @@ my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib) |
| 84 |
|
| 85 |
$no_rc2 = 1 if disabled("legacy"); |
| 86 |
|
| 87 |
-plan tests => 13; |
| 88 |
+plan tests => 14; |
| 89 |
|
| 90 |
ok(run(test(["pkcs7_test"])), "test pkcs7"); |
| 91 |
|
| 92 |
@@ -941,6 +941,17 @@ subtest "CMS binary input tests\n" => sub { |
| 93 |
"verify binary input with -binary missing -crlfeol"); |
| 94 |
}; |
| 95 |
|
| 96 |
+# Test case for missing MD algorithm (must not segfault) |
| 97 |
+ |
| 98 |
+with({ exit_checker => sub { return shift == 4; } }, |
| 99 |
+ sub { |
| 100 |
+ ok(run(app(['openssl', 'smime', '-verify', '-noverify', |
| 101 |
+ '-inform', 'PEM', |
| 102 |
+ '-in', data_file("pkcs7-md4.pem"), |
| 103 |
+ ])), |
| 104 |
+ "Check failure of EVP_DigestInit is handled correctly"); |
| 105 |
+ }); |
| 106 |
+ |
| 107 |
sub check_availability { |
| 108 |
my $tnam = shift; |
| 109 |
|
| 110 |
diff --git a/test/recipes/80-test_cms_data/pkcs7-md4.pem b/test/recipes/80-test_cms_data/pkcs7-md4.pem |
| 111 |
new file mode 100644 |
| 112 |
index 0000000000..ecff611deb |
| 113 |
--- /dev/null |
| 114 |
+++ b/test/recipes/80-test_cms_data/pkcs7-md4.pem |
| 115 |
@@ -0,0 +1,32 @@ |
| 116 |
+-----BEGIN PKCS7----- |
| 117 |
+MIIFhAYJKoZIhvcNAQcCoIIFdTCCBXECAQExDjAMBggqhkiG9w0CBAUAMB0GCSqG |
| 118 |
+SIb3DQEHAaAQBA5UZXN0IGNvbnRlbnQNCqCCAyQwggMgMIICCKADAgECAgECMA0G |
| 119 |
+CSqGSIb3DQEBCwUAMA0xCzAJBgNVBAMMAkNBMCAXDTE2MDExNTA4MTk0OVoYDzIx |
| 120 |
+MTYwMTE2MDgxOTQ5WjAZMRcwFQYDVQQDDA5zZXJ2ZXIuZXhhbXBsZTCCASIwDQYJ |
| 121 |
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKj/iVhhha7e2ywP1XP74reoG3p1YCvU |
| 122 |
+fTxzdrWu3pMvfySQbckc9Io4zZ+igBZWy7Qsu5PlFx//DcZD/jE0+CjYdemju4iC |
| 123 |
+76Ny4lNiBUVN4DGX76qdENJYDZ4GnjK7GwhWXWUPP2aOwjagEf/AWTX9SRzdHEIz |
| 124 |
+BniuBDgj5ed1Z9OUrVqpQB+sWRD1DMFkrUrExjVTs5ZqghsVi9GZq+Seb5Sq0pbl |
| 125 |
+V/uMkWSKPCQWxtIZvoJgEztisO0+HbPK+WvfMbl6nktHaKcpxz9K4iIntO+QY9fv |
| 126 |
+0HJJPlutuRvUK2+GaN3VcxK4Q8ncQQ+io0ZPi2eIhA9h/nk0H0qJH7cCAwEAAaN9 |
| 127 |
+MHswHQYDVR0OBBYEFOeb4iqtimw6y3ZR5Y4HmCKX4XOiMB8GA1UdIwQYMBaAFLQR |
| 128 |
+M/HX4l73U54gIhBPhga/H8leMAkGA1UdEwQCMAAwEwYDVR0lBAwwCgYIKwYBBQUH |
| 129 |
+AwEwGQYDVR0RBBIwEIIOc2VydmVyLmV4YW1wbGUwDQYJKoZIhvcNAQELBQADggEB |
| 130 |
+AEG0PE9hQuXlvtUULv9TQ2BXy9MmTjOk+dQwxDhAXYBYMUB6TygsqvPXwpDwz8MS |
| 131 |
+EPGCRqh5cQwtPoElQRU1i4URgcQMZquXScwNFcvE6AATF/PdN/+mOwtqFrlpYfs3 |
| 132 |
+IJIpYL6ViQg4n8pv+b/pCwMmhewQLwCGs9+omHNTOwKjEiVoNaprAfj5Lxt15fS2 |
| 133 |
++zZW0mT9Y4kfEypetrqSAjh8CDK+vaQhkeKdDfJyBfjS4ALfxvCkT3mQnsWFJ9CU |
| 134 |
+TVG3uw6ylSPT3wN3RE0Ofa4rI5PESogQsd/DgBc7dcDO3yoPKGjycR3/GJDqqCxC |
| 135 |
+e9dr6FJEnDjaDf9zNWyTFHExggITMIICDwIBATASMA0xCzAJBgNVBAMMAkNBAgEC |
| 136 |
+MAwGCCqGSIb3DQIEBQCggdQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkq |
| 137 |
+hkiG9w0BCQUxDxcNMjMwMTE4MTU0NzExWjAfBgkqhkiG9w0BCQQxEgQQRXO4TKpp |
| 138 |
+RgA4XHb8bD1pczB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgB |
| 139 |
+ZQMEARYwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN |
| 140 |
+BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0B |
| 141 |
+AQEFAASCAQAe+xlm/TGg/s/7b0xBc3FFnmmUDEe7ljkehIx61OnBV9ZWA+LcBX/7 |
| 142 |
+kmMSMdaHjRq4w8FmwBMLzn0ttXVqf0QuPbBF/E6X5EqK9lpOdkUQhNiN2v+ZfY6c |
| 143 |
+lrH4ADsSD9D+UHw0sxo5KEF+PPuneUfYCJZosFUJosBbuSEXK0C9yfJoDKVE8Syp |
| 144 |
+0vdqh73ogLeNgZLAUGSSB66OmHDxwgAj4qPAv6FHFBy1Xs4uFZER5vniYrH9OrAk |
| 145 |
+Z6XdvzDoYZC4XcGMDtcOpOM6D4owqy5svHPDw8wIlM4GVhrTw7CQmuBz5uRNnf6a |
| 146 |
+ZK3jZIxG1hr/INaNWheHoPIhPblYaVc6 |
| 147 |
+-----END PKCS7----- |
| 148 |
-- |
| 149 |
2.39.1 |
| 150 |
|
Parent Directory
| 
Revision Log
| 
Revision Graph
