File openssl-CVE-2023-0215-3of4.patch of Package openssl-3.27638

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2023-0215-3of4.patch of Package openssl-3.27638

commit 655fb2614742e922039b8997a81c277540c7d71b
Author: Matt Caswell <matt@openssl.org>
Date:   Fri Jan 27 13:49:32 2023 +0000

squash! Fix a UAF resulting from a bug in BIO_new_NDEF
    
    If the aux->asn1_cb() call fails in BIO_new_NDEF then the "out" BIO will
    be part of an invalid BIO chain. This causes a "use after free" when the
    BIO is eventually freed.
    
    Based on an original patch by Viktor Dukhovni and an idea from Theo
    Buehler.
    
    Thanks to Octavio Galland for reporting this issue.

diff --git a/crypto/asn1/bio_ndef.c b/crypto/asn1/bio_ndef.c
index 434fd35d61..ea2c9055cf 100644
--- a/crypto/asn1/bio_ndef.c
+++ b/crypto/asn1/bio_ndef.c
@@ -61,55 +61,59 @@ BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *val, const ASN1_ITEM *it)
     BIO *asn_bio = NULL;
     const ASN1_AUX *aux = it->funcs;
     ASN1_STREAM_ARG sarg;
+    BIO *pop_bio = NULL;
 
     if (!aux || !aux->asn1_cb) {
         ERR_raise(ERR_LIB_ASN1, ASN1_R_STREAMING_NOT_SUPPORTED);
         return NULL;
     }
+    ndef_aux = OPENSSL_zalloc(sizeof(*ndef_aux));
     asn_bio = BIO_new(BIO_f_asn1());
-    if (asn_bio == NULL)
-        return NULL;
+    if (ndef_aux == NULL || asn_bio == NULL)
+        goto err;
+
+    /* ASN1 bio needs to be next to output BIO */
+    out = BIO_push(asn_bio, out);
+    if (out == NULL)
+        goto err;
+    pop_bio = asn_bio;
 
     BIO_asn1_set_prefix(asn_bio, ndef_prefix, ndef_prefix_free);
     BIO_asn1_set_suffix(asn_bio, ndef_suffix, ndef_suffix_free);
 
-    /* ASN1 bio needs to be next to output BIO */
-    if (BIO_push(asn_bio, out) == NULL) {
-        BIO_free(asn_bio);
-        return NULL;
-    }
-
     /*
      * Now let the callback prepend any digest, cipher, etc., that the BIO's
      * ASN1 structure needs.
      */
-    sarg.out = asn_bio;
+
+    sarg.out = out;
     sarg.ndef_bio = NULL;
     sarg.boundary = NULL;
 
     /*
-     * On error, restore input BIO to head of its BIO chain.
-     *
      * The asn1_cb(), must not have mutated asn_bio on error, leaving it in the
      * middle of some partially built, but not returned BIO chain.
      */
-    if (aux->asn1_cb(ASN1_OP_STREAM_PRE, &val, it, &sarg) <= 0
-        || (ndef_aux = OPENSSL_zalloc(sizeof(*ndef_aux))) == NULL) {
-        /* Assumed head of BIO chain with "out" as immediate successor */
-        (void)BIO_pop(asn_bio);
-        BIO_free(asn_bio);
-        return NULL;
-    }
+    if (aux->asn1_cb(ASN1_OP_STREAM_PRE, &val, it, &sarg) <= 0)
+        goto err;
 
     ndef_aux->val = val;
     ndef_aux->it = it;
     ndef_aux->ndef_bio = sarg.ndef_bio;
     ndef_aux->boundary = sarg.boundary;
-    ndef_aux->out = asn_bio;
+    ndef_aux->out = out;
 
-    BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux);
+    if (BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux) <= 0)
+        goto err;
 
     return sarg.ndef_bio;
+
+ err:
+    /* BIO_pop() is NULL safe */
+    (void)BIO_pop(pop_bio);
+    BIO_free(asn_bio);
+    OPENSSL_free(ndef_aux);
+    return NULL;
 }
 
 static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg)

Places

File openssl-CVE-2023-0215-3of4.patch of Package openssl-3.27638

Places