59 lines
2.2 KiB
Diff
59 lines
2.2 KiB
Diff
From e9db03736007721e37c4fba847ce4aa0c4520924 Mon Sep 17 00:00:00 2001
|
|
From: Joseph Sutton <josephsutton@catalyst.net.nz>
|
|
Date: Wed, 12 Oct 2022 13:57:33 +1300
|
|
Subject: [PATCH 15/15] CVE-2022-3437 source4/heimdal: Pass correct length to
|
|
_gssapi_verify_pad()
|
|
|
|
We later subtract 8 when calculating the length of the output message
|
|
buffer. If padlength is excessively high, this calculation can underflow
|
|
and result in a very large positive value.
|
|
|
|
Now we properly constrain the value of padlength so underflow shouldn't
|
|
be possible.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134
|
|
|
|
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
Conflict: NA
|
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.15.11-security-2022-10-25.patch
|
|
---
|
|
selftest/knownfail.d/heimdal-des-overflow | 2 --
|
|
source4/heimdal/lib/gssapi/krb5/unwrap.c | 4 ++--
|
|
2 files changed, 2 insertions(+), 4 deletions(-)
|
|
delete mode 100644 selftest/knownfail.d/heimdal-des-overflow
|
|
|
|
diff --git a/selftest/knownfail.d/heimdal-des-overflow b/selftest/knownfail.d/heimdal-des-overflow
|
|
deleted file mode 100644
|
|
index a7416dc61d9..00000000000
|
|
--- a/selftest/knownfail.d/heimdal-des-overflow
|
|
+++ /dev/null
|
|
@@ -1,2 +0,0 @@
|
|
-^samba.unittests.auth.heimdal_gensec_unwrap_des.test_unwrap_with_padding_truncated_0.none
|
|
-^samba.unittests.auth.heimdal_gensec_unwrap_des.test_unwrap_with_padding_truncated_1.none
|
|
diff --git a/source4/heimdal/lib/gssapi/krb5/unwrap.c b/source4/heimdal/lib/gssapi/krb5/unwrap.c
|
|
index 70d26a75ccf..ed8f7d78ffa 100644
|
|
--- a/source4/heimdal/lib/gssapi/krb5/unwrap.c
|
|
+++ b/source4/heimdal/lib/gssapi/krb5/unwrap.c
|
|
@@ -124,7 +124,7 @@ unwrap_des
|
|
} else {
|
|
/* check pad */
|
|
ret = _gssapi_verify_pad(input_message_buffer,
|
|
- input_message_buffer->length - len,
|
|
+ input_message_buffer->length - len - 8,
|
|
&padlength);
|
|
if (ret)
|
|
return ret;
|
|
@@ -289,7 +289,7 @@ unwrap_des3
|
|
} else {
|
|
/* check pad */
|
|
ret = _gssapi_verify_pad(input_message_buffer,
|
|
- input_message_buffer->length - len,
|
|
+ input_message_buffer->length - len - 8,
|
|
&padlength);
|
|
if (ret)
|
|
return ret;
|
|
--
|
|
2.25.1
|