- 25 Feb, 2019 2 commits
-
-
Matt Caswell authored
Thanks to David Benjamin who reported this, performed the analysis and suggested the patch. I have incorporated some of his analysis in the comments below. This issue can cause an out-of-bounds read. It is believed that this was not reachable until the recent "fixed top" changes. Analysis has so far only identified one code path that can encounter this - although it is possible that others may be found. The one code path only impacts 1.0.2 in certain builds. The fuzzer found a path in RSA where iqmp is too large. If the input is all zeros, the RSA CRT logic will multiply a padded zero by iqmp. Two mitigating factors: - Private keys which trip this are invalid (iqmp is not reduced mod p). Only systems which take untrusted private keys care. - In OpenSSL 1.1.x, there is a check which rejects the oversize iqmp, so the bug is only reproducible in 1.0.2 so far. Fortunately, the bug appears to be relatively harmless. The consequences of bn_cmp_word's misbehavior are: - OpenSSL may crash if the buffers are page-aligned and the previous page is non-existent. - OpenSSL will incorrectly treat two BN_ULONG buffers as not equal when they are equal. - Side channel concerns. The first is indeed a concern and is a DoS bug. The second is fine in this context. bn_cmp_word and bn_cmp_part_words are used to compute abs(a0 - a1) in Karatsuba. If a0 = a1, it does not matter whether we use a0 - a1 or a1 - a0. The third would be worth thinking about, but it is overshadowed by the entire Karatsuba implementation not being constant time. Due to the difficulty of tripping this and the low impact no CVE is felt necessary for this issue. Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8326)
-
David von Oheimb authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8165)
-
- 24 Feb, 2019 3 commits
-
-
Pauli authored
Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/8318)
-
Pauli authored
Reviewed-by:
-
Pauli authored
Reviewed-by:
-
- 22 Feb, 2019 8 commits
-
-
Richard Levitte authored
Ty Baen-Price explains: > Problem and Resolution: > The following lines of code make use of the Microsoft API ExitProcess: > > ``` > Apps\Speed.c line 335: ExitProcess(ret); > Ms\uplink.c line 22: ExitProcess(1); > ``` > > These function calls are made after fatal errors are detected and > program termination is desired. ExitProcess(), however causes > _orderly_ shutdown of a process and all its threads, i.e. it unloads > all dlls and runs all destructors. See MSDN for details of exactly > what happens > (https://msdn.microsoft.com/en-us/library/windows/desktop/ms682658(v=vs.85).aspx ). > The MSDN page states that ExitProcess should never be called unless > it is _known to be safe_ to call it. These calls should simply be > replaced with calls to TerminateProcess(), which is what should be > called for _disorderly_ shutdown. > > An example of usage: > > ``` > TerminateProcess(GetCurrentProcess(), exitcode); > ``` > > Effect of Problem: > Because of a compilation error (wrong c++ runtime), my program > executed the uplink.c ExitProcess() call. This caused the single > OpenSSL thread to start executing the destructors of all my dlls, > and their objects. Unfortunately, about 30 other threads were > happily using those objects at that time, eventually causing a > 0xC0000005 ACCESS_VIOLATION. Obviously an ACCESS_VIOLATION is the > best case scenario, as I'm sure you can imagine at the consequences > of undiscovered memory corruption, even in a terminating process. And on the subject of `TerminateProcess()` being asynchronous: > That is technically true, but I think it's probably synchronous > "enough" for your purposes, since a call to TerminateProcess > suspends execution of all threads in the target process. This means > it's really only asynchronous if you're calling TerminateProcess one > some _other_ process. If you're calling TerminateProcess on your own > process, you'll never return from the TerminateProcess call. Fixes #2489 Was originally RT-4526 Reviewed-by:
-
Matt Caswell authored
Prior to this commit we were keeping a count of how many KeyUpdates we have processed and failing if we had had too many. This simplistic approach is not sufficient for long running connections. Since many KeyUpdates would not be a particular good DoS route anyway, the simplest solution is to simply remove the key update count. Fixes #8068 Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8299)
-
Dr. Matthias St. Pierre authored
Fixes #7950 It was reported that there might be a null pointer dereference in the implementation of the dasync_aes_128_cbc_hmac_sha1() cipher, because EVP_aes_128_cbc_hmac_sha1() can return a null pointer if AES-NI is not available. It took some analysis to find out that this is not an issue in practice, and these comments explain the reason to comfort further NPD hunters. Detected by GitHub user @wurongxin1987 using the Sourcebrella Pinpoint static analyzer. Reviewed-by:
-
Eneas U de Queiroz authored
This restores the behavior of previous versions of the /dev/crypto engine, in alignment with the default implementation. Reported-by:
Gerard Looije <lglooije@hotmail.com> Signed-off-by:
Eneas U de Queiroz <cote2004-github@yahoo.com> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8213)
-
Eneas U de Queiroz authored
Call close(cfd) before setting cfd = -1. Signed-off-by:
-
Eneas U de Queiroz authored
This fixes commit c703a808 , which had a mistake in cipher_ctrl function. Move the /dev/crypto session cleanup code to its own function. Signed-off-by:
-
Eneas U de Queiroz authored
The devcrypto MODULES line was missing the "engine" attribute. Signed-off-by:
-
Paul Yang authored
Reviewed-by:
-
- 21 Feb, 2019 4 commits
-
-
Kurt Roeckx authored
Reviewed-by: -
Kurt Roeckx authored
doc-nits says that over needs a parameter Reviewed-by: -
Matt Caswell authored
The aes128_cbc_hmac_sha1 cipher in the dasync engine is broken. Probably by commit e38c2e85 which removed use of the "enc" variable...but not completely. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8291)
-
Hubert Kario authored
The option is a flag for Options, not a standalone setting. Reviewed-by:
-
- 20 Feb, 2019 5 commits
-
-
Markus Stockhausen authored
registers. As the AES table is already 1K aligned we can use it everywhere and speedup table address calculation by 10%. Performance numbers: decryption 16B 64B 256B 1024B 8192B ------------------------------------------------------------------- aes-256-cbc 5636.84k 6443.26k 6689.02k 6752.94k 6766.59k bef. aes-256-cbc 6200.31k 7195.71k 7504.30k 7585.11k 7599.45k aft. ------------------------------------------------------------------- aes-128-cbc 7313.85k 8653.67k 9079.55k 9188.35k 9205.08k bef. aes-128-cbc 7925.38k 9557.99k 10092.37k 10232.15k 10272.77k aft. encryption 16B 64B 256B 1024B 8192B ------------------------------------------------------------------- aes-256 cbc 6009.65k 6592.70k 6766.59k 6806.87k 6815.74k bef. aes-256 cbc 6643.93k 7388.69k 7605.33k 7657.81k 7675.90k aft. ------------------------------------------------------------------- aes-128 cbc 7862.09k 8892.48k 9214.04k 9291.78k 9311.57k bef. aes-128 cbc 8639.29k 9881.17k 10265.86k 10363.56k 10392.92k aft. Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Nicola Tuveri authored
Reviewed-by:
-
Nicola Tuveri authored
This commit adds a simple unit test to make sure that the constant-time flag does not "leak" among BN_CTX frames: - test_ctx_consttime_flag() initializes (and later frees before returning) a BN_CTX object, then it calls in sequence test_ctx_set_ct_flag() and test_ctx_check_ct_flag() using the same BN_CTX object. The process is run twice, once with a "normal" BN_CTX_new() object, then with a BN_CTX_secure_new() one. - test_ctx_set_ct_flag() starts a frame in the given BN_CTX and sets the BN_FLG_CONSTTIME flag on some of the BIGNUMs obtained from the frame before ending it. - test_ctx_check_ct_flag() then starts a new frame and gets a number of BIGNUMs from it. In absence of leaks, none of the BIGNUMs in the new frame should have BN_FLG_CONSTTIME set. In actual BN_CTX usage inside libcrypto the leak could happen at any depth level in the BN_CTX stack, with varying results depending on the patterns of sibling trees of nested function calls sharing the same BN_CTX object, and the effect of unintended BN_FLG_CONSTTIME on the called BN_* functions. This simple unit test abstracts away this complexity and verifies that the leak does not happen between two sibling functions sharing the same BN_CTX object at the same level of nesting. Reviewed-by:
-
Richard Levitte authored
Because test order can be randomized, running foo_init() as a separate test is unsafe practice. Instead, we make it possible to call it multiple times, and call it at the start of each separate test. Reviewed-by:
-
- 19 Feb, 2019 7 commits
-
-
Andy Polyakov authored
E.g. on MIPS64 it gives >20% improvement... Reviewed-by:
-
Ionut Mihalcea authored
Reviewed-by:
Ben Kaduk <kaduk@mit.edu> Reviewed-by:
-
Matthias Kraft authored
The AIX binder needs to be instructed that the output will have no entry point (see AIX' ld manual: -e in the Flags section; autoexp and noentry in the Binder section). Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
In TLSv1.3 it is illegal to interleave handshake records with non handshake records. Fixes #8189 Reviewed-by:
-
Richard Levitte authored
There were some faults that got caught by the updated doc-nits Reviewed-by:
-
Pauli authored
A randomised order causes failure due to unintentional dependencies between two of the test cases. [extended tests] Reviewed-by:
-
- 18 Feb, 2019 8 commits
-
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
While we're at it, we also check for names that contain white-space, as they are invalid. Reviewed-by:
-
Corinna Vinschen authored
Cygwin binaries should not enforce text mode these days, just use text mode if the underlying mount point requests it CLA: trivial Signed-off-by:
Corinna Vinschen <vinschen@redhat.com> Reviewed-by:
-
Richard Levitte authored
The NAME section format is comma separated names to the left of the left of the dash, free form on the right. If we don't follow that form, programs like apropos(1) and whatis(1) can't do their job properly. Reviewed-by:
-
Richard Levitte authored
- Add a bit more text about that is expected of the user or OSSL_METHOD_STOREs. - Clarify what a method and what a numeric identity are. - Change all mentions of 'implementation' and 'result' to 'method'. To clarify further: OpenSSL has used the term 'method' for structures that mainly contains function pointers. Those are the methods that are expected to be stored away in OSSL_METHOD_STOREs. In the end, however, it's the caller's responsibility to define exactly what they want to store, as long as its 'methods' are associated with a numeric identity and properties. Reviewed-by:
-
Matt Caswell authored
Found by Coverity Reviewed-by:
-
Pauli authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8224)
-
Pauli authored
Properties are a sequence of comma separated name=value pairs. A name without a corresponding value is assumed to be a Boolean and have the true value 'yes'. Values are either strings or numbers. Strings can be quoted either _"_ or _'_ or unquoted (with restrictions). There are no escape characters inside strings. Number are either decimal digits or '0x' followed by hexidecimal digits. Numbers are represented internally as signed sixty four bit values. Queries on properties are a sequence comma separated conditional tests. These take the form of name=value (equality test), name!=value (inequality test) or name (Boolean test for truth). Queries can be parsed, compared against a definition or merged pairwise. Reviewed-by:
-
- 17 Feb, 2019 3 commits
-
-
Vedran Miletić authored
CLA: trivial Reviewed-by:
-
Jan Macku authored
CLA: trivial Reviewed-by:
-
David Benjamin authored
Reviewed-by:
-
