Skip to content

Commit 25bb8ef

Browse files
tobiasb-mstobiasb-ms
authored
patch openssl with null checks against ContentInfo (#7892)
1 parent c214394 commit 25bb8ef

6 files changed

Lines changed: 211 additions & 24 deletions

File tree

‎SPECS/openssl/openssl-1.1.1-add-null-checks-where-contentinfo-data-can-be-null.patch‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
From 03b3941d60c4bce58fab69a0c22377ab439bc0e8 Mon Sep 17 00:00:00 2001
2+
From: Matt Caswell <matt@openssl.org>
3+
Date: Fri, 19 Jan 2024 11:28:58 +0000
4+
Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL
5+
6+
PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
7+
optional and can be NULL even if the "type" is a valid value. OpenSSL
8+
was not properly accounting for this and a NULL dereference can occur
9+
causing a crash.
10+
11+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
12+
Reviewed-by: Hugo Landau <hlandau@openssl.org>
13+
Reviewed-by: Neil Horman <nhorman@openssl.org>
14+
---
15+
crypto/err/openssl.txt | 3 ++-
16+
crypto/pkcs12/p12_add.c | 19 +++++++++++++++++++
17+
crypto/pkcs12/p12_mutl.c | 5 +++++
18+
crypto/pkcs12/p12_npas.c | 5 +++--
19+
crypto/pkcs12/pk12err.c | 4 +++-
20+
crypto/pkcs7/pk7_mime.c | 8 ++++++--
21+
include/openssl/pkcs12err.h | 3 ++-
22+
7 files changed, 40 insertions(+), 7 deletions(-)
23+
24+
diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
25+
index f302dbc06..900b11ee9 100644
26+
--- a/crypto/err/openssl.txt
27+
+++ b/crypto/err/openssl.txt
28+
@@ -1,4 +1,4 @@
29+
-# Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
30+
+# Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
31+
#
32+
# Licensed under the OpenSSL license (the "License"). You may not use
33+
# this file except in compliance with the License. You can obtain a copy
34+
@@ -970,6 +970,7 @@ PKCS12_F_PKCS12_SETUP_MAC:122:PKCS12_setup_mac
35+
PKCS12_F_PKCS12_SET_MAC:123:PKCS12_set_mac
36+
PKCS12_F_PKCS12_UNPACK_AUTHSAFES:130:PKCS12_unpack_authsafes
37+
PKCS12_F_PKCS12_UNPACK_P7DATA:131:PKCS12_unpack_p7data
38+
+PKCS12_F_PKCS12_UNPACK_P7ENCDATA:134:PKCS12_unpack_p7encdata
39+
PKCS12_F_PKCS12_VERIFY_MAC:126:PKCS12_verify_mac
40+
PKCS12_F_PKCS8_ENCRYPT:125:PKCS8_encrypt
41+
PKCS12_F_PKCS8_SET0_PBE:132:PKCS8_set0_pbe
42+
diff --git a/crypto/pkcs12/p12_add.c b/crypto/pkcs12/p12_add.c
43+
index af184c86a..f2fbe9660 100644
44+
--- a/crypto/pkcs12/p12_add.c
45+
+++ b/crypto/pkcs12/p12_add.c
46+
@@ -76,6 +76,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7data(PKCS7 *p7)
47+
PKCS12_R_CONTENT_TYPE_NOT_DATA);
48+
return NULL;
49+
}
50+
+
51+
+ if (p7->d.data == NULL) {
52+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, PKCS12_R_DECODE_ERROR);
53+
+ return NULL;
54+
+ }
55+
+
56+
return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS));
57+
}
58+
59+
@@ -132,6 +138,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass,
60+
{
61+
if (!PKCS7_type_is_encrypted(p7))
62+
return NULL;
63+
+
64+
+ if (p7->d.encrypted == NULL) {
65+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7ENCDATA, PKCS12_R_DECODE_ERROR);
66+
+ return NULL;
67+
+ }
68+
+
69+
return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm,
70+
ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
71+
pass, passlen,
72+
@@ -159,6 +171,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12)
73+
PKCS12_R_CONTENT_TYPE_NOT_DATA);
74+
return NULL;
75+
}
76+
+
77+
+ if (p12->authsafes->d.data == NULL) {
78+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,
79+
+ PKCS12_R_DECODE_ERROR);
80+
+ return NULL;
81+
+ }
82+
+
83+
return ASN1_item_unpack(p12->authsafes->d.data,
84+
ASN1_ITEM_rptr(PKCS12_AUTHSAFES));
85+
}
86+
diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
87+
index 3658003fe..766c9c1e9 100644
88+
--- a/crypto/pkcs12/p12_mutl.c
89+
+++ b/crypto/pkcs12/p12_mutl.c
90+
@@ -93,6 +93,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
91+
return 0;
92+
}
93+
94+
+ if (p12->authsafes->d.data == NULL) {
95+
+ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR);
96+
+ return 0;
97+
+ }
98+
+
99+
salt = p12->mac->salt->data;
100+
saltlen = p12->mac->salt->length;
101+
if (!p12->mac->iter)
102+
diff --git a/crypto/pkcs12/p12_npas.c b/crypto/pkcs12/p12_npas.c
103+
index 0334289a8..130337638 100644
104+
--- a/crypto/pkcs12/p12_npas.c
105+
+++ b/crypto/pkcs12/p12_npas.c
106+
@@ -78,8 +78,9 @@ static int newpass_p12(PKCS12 *p12, const char *oldpass, const char *newpass)
107+
bags = PKCS12_unpack_p7data(p7);
108+
} else if (bagnid == NID_pkcs7_encrypted) {
109+
bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
110+
- if (!alg_get(p7->d.encrypted->enc_data->algorithm,
111+
- &pbe_nid, &pbe_iter, &pbe_saltlen))
112+
+ if (p7->d.encrypted == NULL
113+
+ || !alg_get(p7->d.encrypted->enc_data->algorithm,
114+
+ &pbe_nid, &pbe_iter, &pbe_saltlen))
115+
goto err;
116+
} else {
117+
continue;
118+
diff --git a/crypto/pkcs12/pk12err.c b/crypto/pkcs12/pk12err.c
119+
index 38ce5197e..224941d74 100644
120+
--- a/crypto/pkcs12/pk12err.c
121+
+++ b/crypto/pkcs12/pk12err.c
122+
@@ -1,6 +1,6 @@
123+
/*
124+
* Generated by util/mkerr.pl DO NOT EDIT
125+
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
126+
+ * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
127+
*
128+
* Licensed under the OpenSSL license (the "License"). You may not use
129+
* this file except in compliance with the License. You can obtain a copy
130+
@@ -58,6 +58,8 @@ static const ERR_STRING_DATA PKCS12_str_functs[] = {
131+
"PKCS12_unpack_authsafes"},
132+
{ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS12_UNPACK_P7DATA, 0),
133+
"PKCS12_unpack_p7data"},
134+
+ {ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS12_UNPACK_P7ENCDATA, 0),
135+
+ "PKCS12_unpack_p7encdata"},
136+
{ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS12_VERIFY_MAC, 0),
137+
"PKCS12_verify_mac"},
138+
{ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS8_ENCRYPT, 0), "PKCS8_encrypt"},
139+
diff --git a/crypto/pkcs7/pk7_mime.c b/crypto/pkcs7/pk7_mime.c
140+
index 19e686814..b457108c9 100644
141+
--- a/crypto/pkcs7/pk7_mime.c
142+
+++ b/crypto/pkcs7/pk7_mime.c
143+
@@ -30,10 +30,14 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
144+
{
145+
STACK_OF(X509_ALGOR) *mdalgs;
146+
int ctype_nid = OBJ_obj2nid(p7->type);
147+
- if (ctype_nid == NID_pkcs7_signed)
148+
+
149+
+ if (ctype_nid == NID_pkcs7_signed) {
150+
+ if (p7->d.sign == NULL)
151+
+ return 0;
152+
mdalgs = p7->d.sign->md_algs;
153+
- else
154+
+ } else {
155+
mdalgs = NULL;
156+
+ }
157+
158+
flags ^= SMIME_OLDMIME;
159+
160+
diff --git a/include/openssl/pkcs12err.h b/include/openssl/pkcs12err.h
161+
index eff5eb260..b0f5446c0 100644
162+
--- a/include/openssl/pkcs12err.h
163+
+++ b/include/openssl/pkcs12err.h
164+
@@ -1,6 +1,6 @@
165+
/*
166+
* Generated by util/mkerr.pl DO NOT EDIT
167+
- * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
168+
+ * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
169+
*
170+
* Licensed under the OpenSSL license (the "License"). You may not use
171+
* this file except in compliance with the License. You can obtain a copy
172+
@@ -49,6 +49,7 @@ int ERR_load_PKCS12_strings(void);
173+
# define PKCS12_F_PKCS12_SET_MAC 123
174+
# define PKCS12_F_PKCS12_UNPACK_AUTHSAFES 130
175+
# define PKCS12_F_PKCS12_UNPACK_P7DATA 131
176+
+# define PKCS12_F_PKCS12_UNPACK_P7ENCDATA 134
177+
# define PKCS12_F_PKCS12_VERIFY_MAC 126
178+
# define PKCS12_F_PKCS8_ENCRYPT 125
179+
# define PKCS12_F_PKCS8_SET0_PBE 132
180+
--
181+
2.33.8
182+

‎SPECS/openssl/openssl.spec‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: Utilities from the general purpose cryptography library with TLS implementation
55
Name: openssl
66
Version: 1.1.1k
7-
Release: 28%{?dist}
7+
Release: 29%{?dist}
88
License: OpenSSL
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
@@ -59,6 +59,7 @@ Patch35: CVE-2023-0466.patch
5959
Patch36: CVE-2023-2650.patch
6060
Patch37: CVE-2023-3817.patch
6161
Patch38: openssl-1.1.1-improve-safety-of-DH.patch
62+
Patch39: openssl-1.1.1-add-null-checks-where-contentinfo-data-can-be-null.patch
6263
BuildRequires: perl-Test-Warnings
6364
BuildRequires: perl-Text-Template
6465
BuildRequires: perl(FindBin)
@@ -67,7 +68,7 @@ Requires: %{name}-libs = %{version}-%{release}
6768
Requires: glibc
6869
Requires: libgcc
6970
Conflicts: httpd <= 2.4.37
70-
%if %{with_check}
71+
%if 0%{?with_check}
7172
BuildRequires: perl
7273
BuildRequires: perl(Math::BigInt)
7374
BuildRequires: perl(Test::Harness)
@@ -170,6 +171,7 @@ cp %{SOURCE4} test/
170171
%patch36 -p1
171172
%patch37 -p1
172173
%patch38 -p1
174+
%patch39 -p1
173175

174176
%build
175177
# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
@@ -359,6 +361,9 @@ rm -f %{buildroot}%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist
359361
%postun libs -p /sbin/ldconfig
360362

361363
%changelog
364+
* Wed Feb 14 2024 Tobias Brick <tobiasb@microsoft.com> - 1.1.1k-29
365+
- Introduce patch to correctly address NULL ContentInfo data
366+
362367
* Wed Dec 06 2023 Muhammad Falak <mwani@microsoft.com> - 1.1.1k-28
363368
- Introduce patch to correctly address exessively long DH keys
364369

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,11 @@ texinfo-6.8-1.cm2.aarch64.rpm
165165
gtk-doc-1.33.2-1.cm2.noarch.rpm
166166
autoconf-2.71-3.cm2.noarch.rpm
167167
automake-1.16.5-1.cm2.noarch.rpm
168-
openssl-1.1.1k-28.cm2.aarch64.rpm
169-
openssl-devel-1.1.1k-28.cm2.aarch64.rpm
170-
openssl-libs-1.1.1k-28.cm2.aarch64.rpm
171-
openssl-perl-1.1.1k-28.cm2.aarch64.rpm
172-
openssl-static-1.1.1k-28.cm2.aarch64.rpm
168+
openssl-1.1.1k-29.cm2.aarch64.rpm
169+
openssl-devel-1.1.1k-29.cm2.aarch64.rpm
170+
openssl-libs-1.1.1k-29.cm2.aarch64.rpm
171+
openssl-perl-1.1.1k-29.cm2.aarch64.rpm
172+
openssl-static-1.1.1k-29.cm2.aarch64.rpm
173173
libcap-2.60-2.cm2.aarch64.rpm
174174
libcap-devel-2.60-2.cm2.aarch64.rpm
175175
debugedit-5.0-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,11 @@ texinfo-6.8-1.cm2.x86_64.rpm
165165
gtk-doc-1.33.2-1.cm2.noarch.rpm
166166
autoconf-2.71-3.cm2.noarch.rpm
167167
automake-1.16.5-1.cm2.noarch.rpm
168-
openssl-1.1.1k-28.cm2.x86_64.rpm
169-
openssl-devel-1.1.1k-28.cm2.x86_64.rpm
170-
openssl-libs-1.1.1k-28.cm2.x86_64.rpm
171-
openssl-perl-1.1.1k-28.cm2.x86_64.rpm
172-
openssl-static-1.1.1k-28.cm2.x86_64.rpm
168+
openssl-1.1.1k-29.cm2.x86_64.rpm
169+
openssl-devel-1.1.1k-29.cm2.x86_64.rpm
170+
openssl-libs-1.1.1k-29.cm2.x86_64.rpm
171+
openssl-perl-1.1.1k-29.cm2.x86_64.rpm
172+
openssl-static-1.1.1k-29.cm2.x86_64.rpm
173173
libcap-2.60-2.cm2.x86_64.rpm
174174
libcap-devel-2.60-2.cm2.x86_64.rpm
175175
debugedit-5.0-2.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -270,12 +270,12 @@ npth-1.6-4.cm2.aarch64.rpm
270270
npth-debuginfo-1.6-4.cm2.aarch64.rpm
271271
npth-devel-1.6-4.cm2.aarch64.rpm
272272
ntsysv-1.20-4.cm2.aarch64.rpm
273-
openssl-1.1.1k-28.cm2.aarch64.rpm
274-
openssl-debuginfo-1.1.1k-28.cm2.aarch64.rpm
275-
openssl-devel-1.1.1k-28.cm2.aarch64.rpm
276-
openssl-libs-1.1.1k-28.cm2.aarch64.rpm
277-
openssl-perl-1.1.1k-28.cm2.aarch64.rpm
278-
openssl-static-1.1.1k-28.cm2.aarch64.rpm
273+
openssl-1.1.1k-29.cm2.aarch64.rpm
274+
openssl-debuginfo-1.1.1k-29.cm2.aarch64.rpm
275+
openssl-devel-1.1.1k-29.cm2.aarch64.rpm
276+
openssl-libs-1.1.1k-29.cm2.aarch64.rpm
277+
openssl-perl-1.1.1k-29.cm2.aarch64.rpm
278+
openssl-static-1.1.1k-29.cm2.aarch64.rpm
279279
p11-kit-0.24.1-1.cm2.aarch64.rpm
280280
p11-kit-debuginfo-0.24.1-1.cm2.aarch64.rpm
281281
p11-kit-devel-0.24.1-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -276,12 +276,12 @@ npth-1.6-4.cm2.x86_64.rpm
276276
npth-debuginfo-1.6-4.cm2.x86_64.rpm
277277
npth-devel-1.6-4.cm2.x86_64.rpm
278278
ntsysv-1.20-4.cm2.x86_64.rpm
279-
openssl-1.1.1k-28.cm2.x86_64.rpm
280-
openssl-debuginfo-1.1.1k-28.cm2.x86_64.rpm
281-
openssl-devel-1.1.1k-28.cm2.x86_64.rpm
282-
openssl-libs-1.1.1k-28.cm2.x86_64.rpm
283-
openssl-perl-1.1.1k-28.cm2.x86_64.rpm
284-
openssl-static-1.1.1k-28.cm2.x86_64.rpm
279+
openssl-1.1.1k-29.cm2.x86_64.rpm
280+
openssl-debuginfo-1.1.1k-29.cm2.x86_64.rpm
281+
openssl-devel-1.1.1k-29.cm2.x86_64.rpm
282+
openssl-libs-1.1.1k-29.cm2.x86_64.rpm
283+
openssl-perl-1.1.1k-29.cm2.x86_64.rpm
284+
openssl-static-1.1.1k-29.cm2.x86_64.rpm
285285
p11-kit-0.24.1-1.cm2.x86_64.rpm
286286
p11-kit-debuginfo-0.24.1-1.cm2.x86_64.rpm
287287
p11-kit-devel-0.24.1-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)