|
| 1 | +From 5770296d904e90f15f38f77dfc2e43fdf5efc083 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Roland Shoemaker <roland@golang.org> |
| 3 | +Date: Tue, 9 Nov 2021 11:45:57 -0800 |
| 4 | +Subject: [PATCH] ssh: don't assume packet plaintext size |
| 5 | + |
| 6 | +When reading GCM and ChaChaPoly1305 packets, don't make assumptions |
| 7 | +about the size of the enciphered plaintext. This fixes two panics |
| 8 | +caused by standards non-compliant malformed packets. |
| 9 | + |
| 10 | +Thanks to Rod Hynes, Psiphon Inc. for reporting this issue. |
| 11 | + |
| 12 | +Fixes golang/go#49932 |
| 13 | +Fixes CVE-2021-43565 |
| 14 | + |
| 15 | +Change-Id: I660cff39d197e0d04ec44d11d792b22d954df2ef |
| 16 | +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1262659 |
| 17 | +Reviewed-by: Katie Hockman <katiehockman@google.com> |
| 18 | +Reviewed-by: Julie Qiu <julieqiu@google.com> |
| 19 | +Reviewed-on: https://go-review.googlesource.com/c/crypto/+/368814 |
| 20 | +Trust: Roland Shoemaker <roland@golang.org> |
| 21 | +Trust: Katie Hockman <katie@golang.org> |
| 22 | +Run-TryBot: Roland Shoemaker <roland@golang.org> |
| 23 | +TryBot-Result: Gopher Robot <gobot@golang.org> |
| 24 | +Reviewed-by: Julie Qiu <julie@golang.org> |
| 25 | +Reviewed-by: Katie Hockman <katie@golang.org> |
| 26 | +--- |
| 27 | + ssh/cipher.go | 8 ++++ |
| 28 | + ssh/cipher_test.go | 100 +++++++++++++++++++++++++++++++++++++++++++++ |
| 29 | + 2 files changed, 108 insertions(+) |
| 30 | + |
| 31 | +diff --git a/vendor/golang.org/x/crypto/ssh/cipher.go b/vendor/golang.org/x/crypto/ssh/cipher.go |
| 32 | +index bddbde5dbd..f8bdf4984c 100644 |
| 33 | +--- a/vendor/golang.org/x/crypto/ssh/cipher.go |
| 34 | ++++ b/vendor/golang.org/x/crypto/ssh/cipher.go |
| 35 | +@@ -394,6 +394,10 @@ func (c *gcmCipher) readCipherPacket(seqNum uint32, r io.Reader) ([]byte, error) |
| 36 | + } |
| 37 | + c.incIV() |
| 38 | + |
| 39 | ++ if len(plain) == 0 { |
| 40 | ++ return nil, errors.New("ssh: empty packet") |
| 41 | ++ } |
| 42 | ++ |
| 43 | + padding := plain[0] |
| 44 | + if padding < 4 { |
| 45 | + // padding is a byte, so it automatically satisfies |
| 46 | +@@ -710,6 +714,10 @@ func (c *chacha20Poly1305Cipher) readCipherPacket(seqNum uint32, r io.Reader) ([ |
| 47 | + plain := c.buf[4:contentEnd] |
| 48 | + s.XORKeyStream(plain, plain) |
| 49 | + |
| 50 | ++ if len(plain) == 0 { |
| 51 | ++ return nil, errors.New("ssh: empty packet") |
| 52 | ++ } |
| 53 | ++ |
| 54 | + padding := plain[0] |
| 55 | + if padding < 4 { |
| 56 | + // padding is a byte, so it automatically satisfies |
0 commit comments