From 97816fe5421170f156023d4427217b458abb21f4 Mon Sep 17 00:00:00 2001 From: Andy Fiddaman Date: Tue, 30 Jan 2024 16:57:51 +0000 Subject: [PATCH] openssl11: backport fix for CVE-2024-0727 --- build/openssl/patches-1.1/CVE-2024-0727.patch | 110 ++++++++++++++++++ build/openssl/patches-1.1/series | 1 + build/openssl/testsuite-1.1.log | 2 +- 3 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 build/openssl/patches-1.1/CVE-2024-0727.patch diff --git a/build/openssl/patches-1.1/CVE-2024-0727.patch b/build/openssl/patches-1.1/CVE-2024-0727.patch new file mode 100644 index 0000000000..1bbd4c17c2 --- /dev/null +++ b/build/openssl/patches-1.1/CVE-2024-0727.patch @@ -0,0 +1,110 @@ +From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Fri, 19 Jan 2024 11:28:58 +0000 +Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL + +PKCS12 structures contain PKCS7 ContentInfo fields. These fields are +optional and can be NULL even if the "type" is a valid value. OpenSSL +was not properly accounting for this and a NULL dereference can occur +causing a crash. + +CVE-2024-0727 + +Reviewed-by: Tomas Mraz +Reviewed-by: Hugo Landau +Reviewed-by: Neil Horman +(Merged from https://github.com/openssl/openssl/pull/23362) + +(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c) +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c +--- a~/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00 +@@ -76,6 +76,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p7->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); + } + +@@ -132,6 +139,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + { + if (!PKCS7_type_is_encrypted(p7)) + return NULL; ++ ++ if (p7->d.encrypted == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, + ASN1_ITEM_rptr(PKCS12_SAFEBAGS), + pass, passlen, +@@ -159,6 +173,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + } +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c +--- a~/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00 +@@ -93,6 +93,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, c + return 0; + } + ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR); ++ return 0; ++ } ++ + salt = p12->mac->salt->data; + saltlen = p12->mac->salt->length; + if (!p12->mac->iter) +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c +--- a~/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00 +@@ -78,7 +78,8 @@ static int newpass_p12(PKCS12 *p12, cons + bags = PKCS12_unpack_p7data(p7); + } else if (bagnid == NID_pkcs7_encrypted) { + bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); +- if (!alg_get(p7->d.encrypted->enc_data->algorithm, ++ if (p7->d.encrypted == NULL ++ || !alg_get(p7->d.encrypted->enc_data->algorithm, + &pbe_nid, &pbe_iter, &pbe_saltlen)) + goto err; + } else { +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c +--- a~/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00 +@@ -30,10 +30,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p + { + STACK_OF(X509_ALGOR) *mdalgs; + int ctype_nid = OBJ_obj2nid(p7->type); +- if (ctype_nid == NID_pkcs7_signed) ++ if (ctype_nid == NID_pkcs7_signed) { ++ if (p7->d.sign == NULL) ++ return 0; + mdalgs = p7->d.sign->md_algs; +- else ++ } else { + mdalgs = NULL; ++ } + + flags ^= SMIME_OLDMIME; + diff --git a/build/openssl/patches-1.1/series b/build/openssl/patches-1.1/series index 4676bd746e..fec88405c4 100644 --- a/build/openssl/patches-1.1/series +++ b/build/openssl/patches-1.1/series @@ -1 +1,2 @@ libs.patch +CVE-2024-0727.patch diff --git a/build/openssl/testsuite-1.1.log b/build/openssl/testsuite-1.1.log index 3e9a5b9747..6ced3e18a8 100644 --- a/build/openssl/testsuite-1.1.log +++ b/build/openssl/testsuite-1.1.log @@ -158,5 +158,5 @@ ../test/recipes/99-test_ecstress.t ................. ok ../test/recipes/99-test_fuzz.t ..................... ok All tests successful. -Files=159, Tests=2652, 322 wallclock secs ( 3.74 usr 1.20 sys + 159.52 cusr 129.48 csys = 293.94 CPU) +Files=159, Tests=2652, 332 wallclock secs ( 3.95 usr 1.14 sys + 167.14 cusr 132.00 csys = 304.23 CPU) Result: PASS