!24 fix CVE-2021-40990 CVE-2021-40991
From: @wk333 Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
5cf8b110eb
56
CVE-2021-41990.patch
Normal file
56
CVE-2021-41990.patch
Normal file
@ -0,0 +1,56 @@
|
||||
From 423a5d56274a1d343e0d2107dfc4fbf0df2dcca5 Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Brunner <tobias@strongswan.org>
|
||||
Date: Tue, 28 Sep 2021 17:52:08 +0200
|
||||
Subject: [PATCH] Reject RSASSA-PSS params with negative salt length
|
||||
|
||||
The `salt_len` member in the struct is of type `ssize_t` because we use
|
||||
negative values for special automatic salt lengths when generating
|
||||
signatures.
|
||||
|
||||
Not checking this could lead to an integer overflow. The value is assigned
|
||||
to the `len` field of a chunk (`size_t`), which is further used in
|
||||
calculations to check the padding structure and (if that is passed by a
|
||||
matching crafted signature value) eventually a memcpy() that will result
|
||||
in a segmentation fault.
|
||||
|
||||
Fixes: a22316520b91 ("signature-params: Add functions to parse/build ASN.1 RSASSA-PSS params")
|
||||
Fixes: 7d6b81648b2d ("gmp: Add support for RSASSA-PSS signature verification")
|
||||
Fixes: CVE-2021-41990
|
||||
---
|
||||
src/libstrongswan/credentials/keys/signature_params.c | 6 +++++-
|
||||
src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c | 2 +-
|
||||
2 files changed, 6 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/libstrongswan/credentials/keys/signature_params.c b/src/libstrongswan/credentials/keys/signature_params.c
|
||||
index d89bd2c96bb5..837de8443d43 100644
|
||||
--- a/src/libstrongswan/credentials/keys/signature_params.c
|
||||
+++ b/src/libstrongswan/credentials/keys/signature_params.c
|
||||
@@ -322,7 +322,11 @@ bool rsa_pss_params_parse(chunk_t asn1, int level0, rsa_pss_params_t *params)
|
||||
case RSASSA_PSS_PARAMS_SALT_LEN:
|
||||
if (object.len)
|
||||
{
|
||||
- params->salt_len = (size_t)asn1_parse_integer_uint64(object);
|
||||
+ params->salt_len = (ssize_t)asn1_parse_integer_uint64(object);
|
||||
+ if (params->salt_len < 0)
|
||||
+ {
|
||||
+ goto end;
|
||||
+ }
|
||||
}
|
||||
break;
|
||||
case RSASSA_PSS_PARAMS_TRAILER:
|
||||
diff --git a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
|
||||
index f9bd1d314dec..3a775090883e 100644
|
||||
--- a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
|
||||
+++ b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
|
||||
@@ -168,7 +168,7 @@ static bool verify_emsa_pss_signature(private_gmp_rsa_public_key_t *this,
|
||||
int i;
|
||||
bool success = FALSE;
|
||||
|
||||
- if (!params)
|
||||
+ if (!params || params->salt_len < 0)
|
||||
{
|
||||
return FALSE;
|
||||
}
|
||||
--
|
||||
2.25.1
|
||||
|
||||
35
CVE-2021-41991.patch
Normal file
35
CVE-2021-41991.patch
Normal file
@ -0,0 +1,35 @@
|
||||
From b667237b3a84f601ef5a707ce8eb861c3a5002d3 Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Brunner <tobias@strongswan.org>
|
||||
Date: Tue, 28 Sep 2021 19:38:22 +0200
|
||||
Subject: [PATCH] cert-cache: Prevent crash due to integer overflow/sign change
|
||||
|
||||
random() allocates values in the range [0, RAND_MAX], with RAND_MAX usually
|
||||
equaling INT_MAX = 2^31-1. Previously, values between 0 and 31 were added
|
||||
directly to that offset before applying`% CACHE_SIZE` to get an index into
|
||||
the cache array. If the random value was very high, this resulted in an
|
||||
integer overflow and a negative index value and, therefore, an out-of-bounds
|
||||
access of the array and in turn dereferencing invalid pointers when trying
|
||||
to acquire the read lock. This most likely results in a segmentation fault.
|
||||
|
||||
Fixes: 764e8b2211ce ("reimplemented certificate cache")
|
||||
Fixes: CVE-2021-41991
|
||||
---
|
||||
src/libstrongswan/credentials/sets/cert_cache.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/libstrongswan/credentials/sets/cert_cache.c b/src/libstrongswan/credentials/sets/cert_cache.c
|
||||
index f1579c60a9bc..ceebb3843725 100644
|
||||
--- a/src/libstrongswan/credentials/sets/cert_cache.c
|
||||
+++ b/src/libstrongswan/credentials/sets/cert_cache.c
|
||||
@@ -151,7 +151,7 @@ static void cache(private_cert_cache_t *this,
|
||||
for (try = 0; try < REPLACE_TRIES; try++)
|
||||
{
|
||||
/* replace a random relation */
|
||||
- offset = random();
|
||||
+ offset = random() % CACHE_SIZE;
|
||||
for (i = 0; i < CACHE_SIZE; i++)
|
||||
{
|
||||
rel = &this->relations[(i + offset) % CACHE_SIZE];
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
Name: strongswan
|
||||
Version: 5.7.2
|
||||
Release: 9
|
||||
Release: 10
|
||||
Summary: An OpenSource IPsec-based VPN and TNC solution
|
||||
License: GPLv2+
|
||||
URL: http://www.strongswan.org/
|
||||
@ -8,6 +8,9 @@ Source0: http://download.strongswan.org/strongswan-%{version}.tar.bz2
|
||||
|
||||
Patch0: strongswan-multiple-definition.patch
|
||||
Patch1: fix-use-of-uninitialized-value.patch
|
||||
Patch2: CVE-2021-41990.patch
|
||||
Patch3: CVE-2021-41991.patch
|
||||
|
||||
|
||||
BuildRequires: gcc systemd-devel gmp-devel libcurl-devel NetworkManager-libnm-devel openldap-devel
|
||||
BuildRequires: openssl-devel sqlite-devel gettext-devel trousers-devel libxml2-devel pam-devel
|
||||
@ -186,6 +189,9 @@ echo "%{_libdir}/strongswan" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.co
|
||||
%{_libexecdir}/strongswan/charon-nm
|
||||
|
||||
%changelog
|
||||
* Mon Oct 25 2021 wangkai <wangkai385@huawei.com> - 5.7.2-10
|
||||
- fix CVE-2021-40990 CVE-2021-40991
|
||||
|
||||
* Thu Sep 09 2021 caodongxia <caodongxia@huawei.com> - 5.7.2-9
|
||||
- fix rpath error
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user