|
| 1 | +From d2bbe37ccf8857197a4b6c36fc0381ab58bb8b09 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Archana Choudhary <archana1@microsoft.com> |
| 3 | +Date: Tue, 29 Apr 2025 09:12:17 +0000 |
| 4 | +Subject: [PATCH] Fix for CVE-2024-4603 |
| 5 | + |
| 6 | +Ported from https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397 |
| 7 | +--- |
| 8 | + .../Library/OpensslLib/openssl/CHANGES.md | 17 +++++++ |
| 9 | + .../OpensslLib/openssl/crypto/dsa/dsa_check.c | 45 +++++++++++++++++-- |
| 10 | + 2 files changed, 58 insertions(+), 4 deletions(-) |
| 11 | + |
| 12 | +diff --git a/CryptoPkg/Library/OpensslLib/openssl/CHANGES.md b/CryptoPkg/Library/OpensslLib/openssl/CHANGES.md |
| 13 | +index 84933a8..34a2e7f 100644 |
| 14 | +--- a/CryptoPkg/Library/OpensslLib/openssl/CHANGES.md |
| 15 | ++++ b/CryptoPkg/Library/OpensslLib/openssl/CHANGES.md |
| 16 | +@@ -30,6 +30,23 @@ breaking changes, and mappings for the large list of deprecated functions. |
| 17 | + |
| 18 | + ### Changes between 3.0.6 and 3.0.7 [1 Nov 2022] |
| 19 | + |
| 20 | ++ * Fixed an issue where checking excessively long DSA keys or parameters may |
| 21 | ++ be very slow. |
| 22 | ++ |
| 23 | ++ Applications that use the functions EVP_PKEY_param_check() or |
| 24 | ++ EVP_PKEY_public_check() to check a DSA public key or DSA parameters may |
| 25 | ++ experience long delays. Where the key or parameters that are being checked |
| 26 | ++ have been obtained from an untrusted source this may lead to a Denial of |
| 27 | ++ Service. |
| 28 | ++ |
| 29 | ++ To resolve this issue DSA keys larger than OPENSSL_DSA_MAX_MODULUS_BITS |
| 30 | ++ will now fail the check immediately with a DSA_R_MODULUS_TOO_LARGE error |
| 31 | ++ reason. |
| 32 | ++ |
| 33 | ++ ([CVE-2024-4603]) |
| 34 | ++ |
| 35 | ++ *Tomáš Mráz* |
| 36 | ++ |
| 37 | + * Fixed two buffer overflows in punycode decoding functions. |
| 38 | + |
| 39 | + A buffer overrun can be triggered in X.509 certificate verification, |
| 40 | +diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/dsa/dsa_check.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/dsa/dsa_check.c |
| 41 | +index 7ee914a..a66fe05 100644 |
| 42 | +--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/dsa/dsa_check.c |
| 43 | ++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/dsa/dsa_check.c |
| 44 | +@@ -19,8 +19,34 @@ |
| 45 | + #include "dsa_local.h" |
| 46 | + #include "crypto/dsa.h" |
| 47 | + |
| 48 | ++static int dsa_precheck_params(const DSA *dsa, int *ret) |
| 49 | ++{ |
| 50 | ++ if (dsa->params.p == NULL || dsa->params.q == NULL) { |
| 51 | ++ ERR_raise(ERR_LIB_DSA, DSA_R_BAD_FFC_PARAMETERS); |
| 52 | ++ *ret = FFC_CHECK_INVALID_PQ; |
| 53 | ++ return 0; |
| 54 | ++ } |
| 55 | ++ |
| 56 | ++ if (BN_num_bits(dsa->params.p) > OPENSSL_DSA_MAX_MODULUS_BITS) { |
| 57 | ++ ERR_raise(ERR_LIB_DSA, DSA_R_MODULUS_TOO_LARGE); |
| 58 | ++ *ret = FFC_CHECK_INVALID_PQ; |
| 59 | ++ return 0; |
| 60 | ++ } |
| 61 | ++ |
| 62 | ++ if (BN_num_bits(dsa->params.q) >= BN_num_bits(dsa->params.p)) { |
| 63 | ++ ERR_raise(ERR_LIB_DSA, DSA_R_BAD_Q_VALUE); |
| 64 | ++ *ret = FFC_CHECK_INVALID_PQ; |
| 65 | ++ return 0; |
| 66 | ++ } |
| 67 | ++ |
| 68 | ++ return 1; |
| 69 | ++} |
| 70 | ++ |
| 71 | + int ossl_dsa_check_params(const DSA *dsa, int checktype, int *ret) |
| 72 | + { |
| 73 | ++ if (!dsa_precheck_params(dsa, ret)) |
| 74 | ++ return 0; |
| 75 | ++ |
| 76 | + if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK) |
| 77 | + return ossl_ffc_params_simple_validate(dsa->libctx, &dsa->params, |
| 78 | + FFC_PARAM_TYPE_DSA, ret); |
| 79 | +@@ -39,6 +65,9 @@ int ossl_dsa_check_params(const DSA *dsa, int checktype, int *ret) |
| 80 | + */ |
| 81 | + int ossl_dsa_check_pub_key(const DSA *dsa, const BIGNUM *pub_key, int *ret) |
| 82 | + { |
| 83 | ++ if (!dsa_precheck_params(dsa, ret)) |
| 84 | ++ return 0; |
| 85 | ++ |
| 86 | + return ossl_ffc_validate_public_key(&dsa->params, pub_key, ret); |
| 87 | + } |
| 88 | + |
| 89 | +@@ -49,6 +78,10 @@ int ossl_dsa_check_pub_key(const DSA *dsa, const BIGNUM *pub_key, int *ret) |
| 90 | + */ |
| 91 | + int ossl_dsa_check_pub_key_partial(const DSA *dsa, const BIGNUM *pub_key, int *ret) |
| 92 | + { |
| 93 | ++ |
| 94 | ++ if (!dsa_precheck_params(dsa, ret)) |
| 95 | ++ return 0; |
| 96 | ++ |
| 97 | + return ossl_ffc_validate_public_key_partial(&dsa->params, pub_key, ret); |
| 98 | + } |
| 99 | + |
| 100 | +@@ -56,8 +89,10 @@ int ossl_dsa_check_priv_key(const DSA *dsa, const BIGNUM *priv_key, int *ret) |
| 101 | + { |
| 102 | + *ret = 0; |
| 103 | + |
| 104 | +- return (dsa->params.q != NULL |
| 105 | +- && ossl_ffc_validate_private_key(dsa->params.q, priv_key, ret)); |
| 106 | ++ if (!dsa_precheck_params(dsa, ret)) |
| 107 | ++ return 0; |
| 108 | ++ |
| 109 | ++ return ossl_ffc_validate_private_key(dsa->params.q, priv_key, ret); |
| 110 | + } |
| 111 | + |
| 112 | + /* |
| 113 | +@@ -70,8 +105,10 @@ int ossl_dsa_check_pairwise(const DSA *dsa) |
| 114 | + BN_CTX *ctx = NULL; |
| 115 | + BIGNUM *pub_key = NULL; |
| 116 | + |
| 117 | +- if (dsa->params.p == NULL |
| 118 | +- || dsa->params.g == NULL |
| 119 | ++ if (!dsa_precheck_params(dsa, &ret)) |
| 120 | ++ return 0; |
| 121 | ++ |
| 122 | ++ if (dsa->params.g == NULL |
| 123 | + || dsa->priv_key == NULL |
| 124 | + || dsa->pub_key == NULL) |
| 125 | + return 0; |
0 commit comments