File openssl-CVE-2014-8275.patch of Package openssl

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2014-8275.patch of Package openssl (Revision f549608142ed02041fbc0ebf86f4f9f7)

Currently displaying revision f549608142ed02041fbc0ebf86f4f9f7 , Show latest

commit a8565530e27718760220df469f0a071c85b9e731
Author: Dr. Stephen Henson <steve@openssl.org>
Date:   Sat Dec 20 15:09:50 2014 +0000

Fix various certificate fingerprint issues.
    
    By using non-DER or invalid encodings outside the signed portion of a
    certificate the fingerprint can be changed without breaking the signature.
    Although no details of the signed portion of the certificate can be changed
    this can cause problems with some applications: e.g. those using the
    certificate fingerprint for blacklists.
    
    1. Reject signatures with non zero unused bits.
    
    If the BIT STRING containing the signature has non zero unused bits reject
    the signature. All current signature algorithms require zero unused bits.
    
    2. Check certificate algorithm consistency.
    
    Check the AlgorithmIdentifier inside TBS matches the one in the
    certificate signature. NB: this will result in signature failure
    errors for some broken certificates.
    
    3. Check DSA/ECDSA signatures use DER.
    
    Reencode DSA/ECDSA signatures and compare with the original received
    signature. Return an error if there is a mismatch.
    
    This will reject various cases including garbage after signature
    (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
    program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
    (negative or with leading zeroes).
    
    CVE-2014-8275
    Reviewed-by: Emilia Käsper <emilia@openssl.org>
    
    (cherry picked from commit 684400ce192dac51df3d3e92b61830a6ef90be3e)

commit 178c562a4621162dbe19a7c34fa2ad558684f40e
Author: Dr. Stephen Henson <steve@openssl.org>
Date:   Tue Jan 6 20:55:38 2015 +0000

use correct function name
    
    Reviewed-by: Rich Salz <rsalz@openssl.org>
    Reviewed-by: Matt Caswell <matt@openssl.org>
    (cherry picked from commit cb62ab4b17818fe66d2fed0a7fe71969131c811b)

commit 5951cc004b96cd681ffdf39d3fc9238a1ff597ae
Author: Dr. Stephen Henson <steve@openssl.org>
Date:   Sun Dec 14 23:14:15 2014 +0000

Constify ASN1_TYPE_cmp add X509_ALGOR_cmp.
    
    Reviewed-by: Emilia Käsper <emilia@openssl.org>
    (cherry picked from commit 4c52816d35681c0533c25fdd3abb4b7c6962302d)

commit 86edf13b1c97526c0cf63c37342aaa01f5442688
Author: Kurt Roeckx <kurt@roeckx.be>
Date:   Mon Dec 15 17:15:16 2014 +0100

Return error when a bit string indicates an invalid amount of bits left
    
    Reviewed-by: Matt Caswell <matt@openssl.org>

Index: openssl-1.0.1i/crypto/asn1/a_verify.c
===================================================================
--- openssl-1.0.1i.orig/crypto/asn1/a_verify.c	2015-01-09 16:52:51.651826120 +0100
+++ openssl-1.0.1i/crypto/asn1/a_verify.c	2015-01-09 16:53:08.806036820 +0100
@@ -90,6 +90,12 @@ int ASN1_verify(i2d_of_void *i2d, X509_A
 		ASN1err(ASN1_F_ASN1_VERIFY,ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
 		goto err;
 		}
+
+	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
+		{
+		ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
+		goto err;
+		}
 	
 	inl=i2d(data,NULL);
 	buf_in=OPENSSL_malloc((unsigned int)inl);
@@ -146,6 +152,12 @@ int ASN1_item_verify(const ASN1_ITEM *it
 		return -1;
 		}
 
+	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
+		{
+		ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
+		return -1;
+		}
+
 	EVP_MD_CTX_init(&ctx);
 
 	/* Convert signature OID into digest and public key OIDs */
Index: openssl-1.0.1i/crypto/dsa/dsa_asn1.c
===================================================================
--- openssl-1.0.1i.orig/crypto/dsa/dsa_asn1.c	2015-01-09 16:52:51.651826120 +0100
+++ openssl-1.0.1i/crypto/dsa/dsa_asn1.c	2015-01-09 16:53:08.806036820 +0100
@@ -176,13 +176,25 @@ int DSA_verify(int type, const unsigned
 	     const unsigned char *sigbuf, int siglen, DSA *dsa)
 	{
 	DSA_SIG *s;
+	const unsigned char *p = sigbuf;
+	unsigned char *der = NULL;
+	int derlen = -1;
 	int ret=-1;
 
 	s = DSA_SIG_new();
 	if (s == NULL) return(ret);
-	if (d2i_DSA_SIG(&s,&sigbuf,siglen) == NULL) goto err;
+	if (d2i_DSA_SIG(&s,&p,siglen) == NULL) goto err;
+	/* Ensure signature uses DER and doesn't have trailing garbage */
+	derlen = i2d_DSA_SIG(s, &der);
+	if (derlen != siglen || memcmp(sigbuf, der, derlen))
+		goto err;
 	ret=DSA_do_verify(dgst,dgst_len,s,dsa);
 err:
+	if (derlen > 0)
+		{
+		OPENSSL_cleanse(der, derlen);
+		OPENSSL_free(der);
+		}
 	DSA_SIG_free(s);
 	return(ret);
 	}
Index: openssl-1.0.1i/crypto/ecdsa/ecs_vrf.c
===================================================================
--- openssl-1.0.1i.orig/crypto/ecdsa/ecs_vrf.c	2015-01-09 16:52:51.651826120 +0100
+++ openssl-1.0.1i/crypto/ecdsa/ecs_vrf.c	2015-01-09 16:53:08.806036820 +0100
@@ -57,6 +57,7 @@
  */
 
 #include "ecs_locl.h"
+#include "cryptlib.h"
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
@@ -84,13 +85,25 @@ int ECDSA_verify(int type, const unsigne
 		const unsigned char *sigbuf, int sig_len, EC_KEY *eckey)
  	{
 	ECDSA_SIG *s;
+	const unsigned char *p = sigbuf;
+	unsigned char *der = NULL;
+	int derlen = -1;
 	int ret=-1;
 
 	s = ECDSA_SIG_new();
 	if (s == NULL) return(ret);
-	if (d2i_ECDSA_SIG(&s, &sigbuf, sig_len) == NULL) goto err;
+	if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) goto err;
+	/* Ensure signature uses DER and doesn't have trailing garbage */
+	derlen = i2d_ECDSA_SIG(s, &der);
+	if (derlen != sig_len || memcmp(sigbuf, der, derlen))
+		goto err;
 	ret=ECDSA_do_verify(dgst, dgst_len, s, eckey);
 err:
+	if (derlen > 0)
+		{
+		OPENSSL_cleanse(der, derlen);
+		OPENSSL_free(der);
+		}
 	ECDSA_SIG_free(s);
 	return(ret);
 	}
Index: openssl-1.0.1i/crypto/x509/x_all.c
===================================================================
--- openssl-1.0.1i.orig/crypto/x509/x_all.c	2015-01-09 16:52:51.651826120 +0100
+++ openssl-1.0.1i/crypto/x509/x_all.c	2015-01-09 16:53:08.806036820 +0100
@@ -72,6 +72,8 @@
 
 int X509_verify(X509 *a, EVP_PKEY *r)
 	{
+	if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature))
+		return 0;
 	return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF),a->sig_alg,
 		a->signature,a->cert_info,r));
 	}
Index: openssl-1.0.1i/crypto/asn1/a_bitstr.c
===================================================================
--- openssl-1.0.1i.orig/crypto/asn1/a_bitstr.c	2015-01-09 16:54:03.083703130 +0100
+++ openssl-1.0.1i/crypto/asn1/a_bitstr.c	2015-01-09 16:54:19.571905429 +0100
@@ -136,11 +136,16 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN
 
 	p= *pp;
 	i= *(p++);
+	if (i > 7)
+		{
+		i=ASN1_R_INVALID_BIT_STRING_BITS_LEFT;
+		goto err;
+		}
 	/* We do this to preserve the settings.  If we modify
 	 * the settings, via the _set_bit function, we will recalculate
 	 * on output */
 	ret->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear */
-	ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|(i&0x07)); /* set */
+	ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|i); /* set */
 
 	if (len-- > 1) /* using one because of the bits left byte */
 		{
Index: openssl-1.0.1i/crypto/asn1/asn1_err.c
===================================================================
--- openssl-1.0.1i.orig/crypto/asn1/asn1_err.c	2015-01-09 16:54:03.083703130 +0100
+++ openssl-1.0.1i/crypto/asn1/asn1_err.c	2015-01-09 16:54:19.571905429 +0100
@@ -246,6 +246,7 @@ static ERR_STRING_DATA ASN1_str_reasons[
 {ERR_REASON(ASN1_R_ILLEGAL_TIME_VALUE)   ,"illegal time value"},
 {ERR_REASON(ASN1_R_INTEGER_NOT_ASCII_FORMAT),"integer not ascii format"},
 {ERR_REASON(ASN1_R_INTEGER_TOO_LARGE_FOR_LONG),"integer too large for long"},
+{ERR_REASON(ASN1_R_INVALID_BIT_STRING_BITS_LEFT),"invalid bit string bits left"},
 {ERR_REASON(ASN1_R_INVALID_BMPSTRING_LENGTH),"invalid bmpstring length"},
 {ERR_REASON(ASN1_R_INVALID_DIGIT)        ,"invalid digit"},
 {ERR_REASON(ASN1_R_INVALID_MIME_TYPE)    ,"invalid mime type"},
Index: openssl-1.0.1i/crypto/asn1/asn1.h
===================================================================
--- openssl-1.0.1i.orig/crypto/asn1/asn1.h	2015-01-09 16:54:03.083703130 +0100
+++ openssl-1.0.1i/crypto/asn1/asn1.h	2015-01-09 16:59:43.213866355 +0100
@@ -776,7 +776,7 @@ DECLARE_ASN1_FUNCTIONS_fname(ASN1_TYPE,
 int ASN1_TYPE_get(ASN1_TYPE *a);
 void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
 int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
-int            ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b);
+int            ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b);
 
 ASN1_OBJECT *	ASN1_OBJECT_new(void );
 void		ASN1_OBJECT_free(ASN1_OBJECT *a);
@@ -1329,6 +1329,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_ILLEGAL_TIME_VALUE			 184
 #define ASN1_R_INTEGER_NOT_ASCII_FORMAT			 185
 #define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG		 128
+#define ASN1_R_INVALID_BIT_STRING_BITS_LEFT		 220
 #define ASN1_R_INVALID_BMPSTRING_LENGTH			 129
 #define ASN1_R_INVALID_DIGIT				 130
 #define ASN1_R_INVALID_MIME_TYPE			 205
Index: openssl-1.0.1i/crypto/asn1/a_type.c
===================================================================
--- openssl-1.0.1i.orig/crypto/asn1/a_type.c	2015-01-09 16:58:54.060265974 +0100
+++ openssl-1.0.1i/crypto/asn1/a_type.c	2015-01-09 16:59:43.213866355 +0100
@@ -113,7 +113,7 @@ IMPLEMENT_STACK_OF(ASN1_TYPE)
 IMPLEMENT_ASN1_SET_OF(ASN1_TYPE)
 
 /* Returns 0 if they are equal, != 0 otherwise. */
-int ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b)
+int ASN1_TYPE_cmp(const ASN1_TYPE *a, const ASN1_TYPE *b)
 	{
 	int result = -1;
 
Index: openssl-1.0.1i/crypto/asn1/x_algor.c
===================================================================
--- openssl-1.0.1i.orig/crypto/asn1/x_algor.c	2015-01-09 16:58:54.061265986 +0100
+++ openssl-1.0.1i/crypto/asn1/x_algor.c	2015-01-09 16:59:43.213866355 +0100
@@ -142,3 +142,14 @@ void X509_ALGOR_set_md(X509_ALGOR *alg,
 	X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type, NULL);
 
 	}
+
+int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b)
+	{
+	int rv;
+	rv = OBJ_cmp(a->algorithm, b->algorithm);
+	if (rv)
+		return rv;
+	if (!a->parameter && !b->parameter)
+		return 0;
+	return ASN1_TYPE_cmp(a->parameter, b->parameter);
+	}
Index: openssl-1.0.1i/crypto/x509/x509.h
===================================================================
--- openssl-1.0.1i.orig/crypto/x509/x509.h	2015-01-09 16:58:54.061265986 +0100
+++ openssl-1.0.1i/crypto/x509/x509.h	2015-01-09 16:59:43.214866367 +0100
@@ -768,6 +768,7 @@ int X509_ALGOR_set0(X509_ALGOR *alg, ASN
 void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
 						X509_ALGOR *algor);
 void X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md);
+int X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b);
 
 X509_NAME *X509_NAME_dup(X509_NAME *xn);
 X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);

Places

File openssl-CVE-2014-8275.patch of Package openssl (Revision f549608142ed02041fbc0ebf86f4f9f7)

Places