isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone
3da501
From d3b6dfd70db844c4499bec6ad6601623a565e674 Mon Sep 17 00:00:00 2001
3da501
From: Tomas Mraz <tomas@openssl.org>
3da501
Date: Wed, 18 Jan 2023 09:27:53 +0100
3da501
Subject: [PATCH 15/18] pk7_doit.c: Check return of BIO_set_md() calls
3da501
3da501
These calls invoke EVP_DigestInit() which can fail for digests
3da501
with implicit fetches. Subsequent EVP_DigestUpdate() from BIO_write()
3da501
or EVP_DigestFinal() from BIO_read() will segfault on NULL
3da501
dereference. This can be triggered by an attacker providing
3da501
PKCS7 data digested with MD4 for example if the legacy provider
3da501
is not loaded.
3da501
3da501
If BIO_set_md() fails the md BIO cannot be used.
3da501
3da501
CVE-2023-0401
3da501
3da501
Reviewed-by: Paul Dale <pauli@openssl.org>
3da501
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
3da501
---
3da501
 crypto/pkcs7/pk7_doit.c | 12 ++++++++++--
3da501
 1 file changed, 10 insertions(+), 2 deletions(-)
3da501
3da501
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
3da501
index bde9ac4787..5e562fbea5 100644
3da501
--- a/crypto/pkcs7/pk7_doit.c
3da501
+++ b/crypto/pkcs7/pk7_doit.c
3da501
@@ -84,7 +84,11 @@ static int pkcs7_bio_add_digest(BIO **pbio, X509_ALGOR *alg,
3da501
     }
3da501
     (void)ERR_pop_to_mark();
3da501
 
3da501
-    BIO_set_md(btmp, md);
3da501
+    if (BIO_set_md(btmp, md) <= 0) {
3da501
+        ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB);
3da501
+        EVP_MD_free(fetched);
3da501
+        goto err;
3da501
+    }
3da501
     EVP_MD_free(fetched);
3da501
     if (*pbio == NULL)
3da501
         *pbio = btmp;
3da501
@@ -522,7 +526,11 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
3da501
             }
3da501
             (void)ERR_pop_to_mark();
3da501
 
3da501
-            BIO_set_md(btmp, md);
3da501
+            if (BIO_set_md(btmp, md) <= 0) {
3da501
+                EVP_MD_free(evp_md);
3da501
+                ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB);
3da501
+                goto err;
3da501
+            }
3da501
             EVP_MD_free(evp_md);
3da501
             if (out == NULL)
3da501
                 out = btmp;
3da501
-- 
3da501
2.39.1
3da501
3da501
From a0f2359613f50b5ca6b74b78bf4b54d7dc925fd2 Mon Sep 17 00:00:00 2001
3da501
From: Tomas Mraz <tomas@openssl.org>
3da501
Date: Wed, 18 Jan 2023 17:07:24 +0100
3da501
Subject: [PATCH 16/18] Add testcase for missing return check of BIO_set_md()
3da501
 calls
3da501
3da501
Reviewed-by: Paul Dale <pauli@openssl.org>
3da501
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
3da501
---
3da501
 test/recipes/80-test_cms.t                  | 15 ++++++++--
3da501
 test/recipes/80-test_cms_data/pkcs7-md4.pem | 32 +++++++++++++++++++++
3da501
 2 files changed, 45 insertions(+), 2 deletions(-)
3da501
 create mode 100644 test/recipes/80-test_cms_data/pkcs7-md4.pem
3da501
3da501
diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t
3da501
index fd53683e6b..d45789de70 100644
3da501
--- a/test/recipes/80-test_cms.t
3da501
+++ b/test/recipes/80-test_cms.t
3da501
@@ -13,7 +13,7 @@ use warnings;
3da501
 use POSIX;
3da501
 use File::Spec::Functions qw/catfile/;
3da501
 use File::Compare qw/compare_text compare/;
3da501
-use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file with/;
3da501
+use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file with data_file/;
3da501
 
3da501
 use OpenSSL::Test::Utils;
3da501
 
3da501
@@ -50,7 +50,7 @@ my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
3da501
 
3da501
 $no_rc2 = 1 if disabled("legacy");
3da501
 
3da501
-plan tests => 13;
3da501
+plan tests => 14;
3da501
 
3da501
 ok(run(test(["pkcs7_test"])), "test pkcs7");
3da501
 
3da501
@@ -941,6 +941,17 @@ subtest "CMS binary input tests\n" => sub {
3da501
        "verify binary input with -binary missing -crlfeol");
3da501
 };
3da501
 
3da501
+# Test case for missing MD algorithm (must not segfault)
3da501
+
3da501
+with({ exit_checker => sub { return shift == 4; } },
3da501
+    sub {
3da501
+        ok(run(app(['openssl', 'smime', '-verify', '-noverify',
3da501
+                    '-inform', 'PEM',
3da501
+                    '-in', data_file("pkcs7-md4.pem"),
3da501
+                   ])),
3da501
+            "Check failure of EVP_DigestInit is handled correctly");
3da501
+    });
3da501
+
3da501
 sub check_availability {
3da501
     my $tnam = shift;
3da501
 
3da501
diff --git a/test/recipes/80-test_cms_data/pkcs7-md4.pem b/test/recipes/80-test_cms_data/pkcs7-md4.pem
3da501
new file mode 100644
3da501
index 0000000000..ecff611deb
3da501
--- /dev/null
3da501
+++ b/test/recipes/80-test_cms_data/pkcs7-md4.pem
3da501
@@ -0,0 +1,32 @@
3da501
+-----BEGIN PKCS7-----
3da501
+MIIFhAYJKoZIhvcNAQcCoIIFdTCCBXECAQExDjAMBggqhkiG9w0CBAUAMB0GCSqG
3da501
+SIb3DQEHAaAQBA5UZXN0IGNvbnRlbnQNCqCCAyQwggMgMIICCKADAgECAgECMA0G
3da501
+CSqGSIb3DQEBCwUAMA0xCzAJBgNVBAMMAkNBMCAXDTE2MDExNTA4MTk0OVoYDzIx
3da501
+MTYwMTE2MDgxOTQ5WjAZMRcwFQYDVQQDDA5zZXJ2ZXIuZXhhbXBsZTCCASIwDQYJ
3da501
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKj/iVhhha7e2ywP1XP74reoG3p1YCvU
3da501
+fTxzdrWu3pMvfySQbckc9Io4zZ+igBZWy7Qsu5PlFx//DcZD/jE0+CjYdemju4iC
3da501
+76Ny4lNiBUVN4DGX76qdENJYDZ4GnjK7GwhWXWUPP2aOwjagEf/AWTX9SRzdHEIz
3da501
+BniuBDgj5ed1Z9OUrVqpQB+sWRD1DMFkrUrExjVTs5ZqghsVi9GZq+Seb5Sq0pbl
3da501
+V/uMkWSKPCQWxtIZvoJgEztisO0+HbPK+WvfMbl6nktHaKcpxz9K4iIntO+QY9fv
3da501
+0HJJPlutuRvUK2+GaN3VcxK4Q8ncQQ+io0ZPi2eIhA9h/nk0H0qJH7cCAwEAAaN9
3da501
+MHswHQYDVR0OBBYEFOeb4iqtimw6y3ZR5Y4HmCKX4XOiMB8GA1UdIwQYMBaAFLQR
3da501
+M/HX4l73U54gIhBPhga/H8leMAkGA1UdEwQCMAAwEwYDVR0lBAwwCgYIKwYBBQUH
3da501
+AwEwGQYDVR0RBBIwEIIOc2VydmVyLmV4YW1wbGUwDQYJKoZIhvcNAQELBQADggEB
3da501
+AEG0PE9hQuXlvtUULv9TQ2BXy9MmTjOk+dQwxDhAXYBYMUB6TygsqvPXwpDwz8MS
3da501
+EPGCRqh5cQwtPoElQRU1i4URgcQMZquXScwNFcvE6AATF/PdN/+mOwtqFrlpYfs3
3da501
+IJIpYL6ViQg4n8pv+b/pCwMmhewQLwCGs9+omHNTOwKjEiVoNaprAfj5Lxt15fS2
3da501
++zZW0mT9Y4kfEypetrqSAjh8CDK+vaQhkeKdDfJyBfjS4ALfxvCkT3mQnsWFJ9CU
3da501
+TVG3uw6ylSPT3wN3RE0Ofa4rI5PESogQsd/DgBc7dcDO3yoPKGjycR3/GJDqqCxC
3da501
+e9dr6FJEnDjaDf9zNWyTFHExggITMIICDwIBATASMA0xCzAJBgNVBAMMAkNBAgEC
3da501
+MAwGCCqGSIb3DQIEBQCggdQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkq
3da501
+hkiG9w0BCQUxDxcNMjMwMTE4MTU0NzExWjAfBgkqhkiG9w0BCQQxEgQQRXO4TKpp
3da501
+RgA4XHb8bD1pczB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgB
3da501
+ZQMEARYwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN
3da501
+BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0B
3da501
+AQEFAASCAQAe+xlm/TGg/s/7b0xBc3FFnmmUDEe7ljkehIx61OnBV9ZWA+LcBX/7
3da501
+kmMSMdaHjRq4w8FmwBMLzn0ttXVqf0QuPbBF/E6X5EqK9lpOdkUQhNiN2v+ZfY6c
3da501
+lrH4ADsSD9D+UHw0sxo5KEF+PPuneUfYCJZosFUJosBbuSEXK0C9yfJoDKVE8Syp
3da501
+0vdqh73ogLeNgZLAUGSSB66OmHDxwgAj4qPAv6FHFBy1Xs4uFZER5vniYrH9OrAk
3da501
+Z6XdvzDoYZC4XcGMDtcOpOM6D4owqy5svHPDw8wIlM4GVhrTw7CQmuBz5uRNnf6a
3da501
+ZK3jZIxG1hr/INaNWheHoPIhPblYaVc6
3da501
+-----END PKCS7-----
3da501
-- 
3da501
2.39.1
3da501