From patchwork Wed Apr 26 07:47:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omkar Patil X-Patchwork-Id: 23005 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57DF6C77B60 for ; Wed, 26 Apr 2023 07:47:47 +0000 (UTC) Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mx.groups.io with SMTP id smtpd.web11.2620.1682495263601555436 for ; Wed, 26 Apr 2023 00:47:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20221208 header.b=dygl1GM3; spf=pass (domain: gmail.com, ip: 209.85.210.173, mailfrom: omkarpatil10.93@gmail.com) Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-63b7588005fso5660223b3a.0 for ; Wed, 26 Apr 2023 00:47:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682495263; x=1685087263; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=t56f1kgoHxq9OD5TmMWMsjIKKz4jrv/44lQX4ORa/9U=; b=dygl1GM3f7d66V/6RgTfB3PKH9PQ17CVzuhbOO93WdsvZVRJMQ+5AJOOJP85JE7rjo 1M5WBqG/8xhzqWyPbHEIEgwwvsGB7Ii9Sl9XHL6Nmd6/dMAL9hduARfsgxFBxgYtd5tS nG4UPZIHehkRliJAf4C7nG0I+GGPq1kjYHJRuXfzLCEK9a0+NervTIIjITYggA2WoVvO olmnAhB6nr9DhMkkFF1MHjpD8Kp7twQqadTlnndGHcRXtHcU/2H1mnP8grzE3ziOC60A gCXmOwimKPFToK6KN5ixIznGxRcozS71eMF6iDyyyLyHkkmQn3T3PcEaX31bfvu+FXpx GO9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682495263; x=1685087263; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=t56f1kgoHxq9OD5TmMWMsjIKKz4jrv/44lQX4ORa/9U=; b=NSrlD8pXEChCZsfDdy4hKjwUJY6VtXTQhcOhp5z5aQ0Duqxv8DInM1diJcKcr0Hy4S /hYz2fdXLFj3kxMgU7yfHnH4zBFtXF202IQSUDPPKwuF1ojErXz/Mw+DIVmXOMzk7BR+ xQ7k/QAut7Qh7CnmPTUDsZe8h4ZNjzomKP72ORAifl79hrIWXGNtQuZfbJ5VmIOHe4e2 YhhDjcpAwunlL4WMizsrC0pB+P80TYKaTbdwWbOuttwnVK5p0icmIPbBq4v8GLArpecm jz7Fft9KqblgrwbewT1f8vzU86hT+ycFGBS+ruxbbTo4JxvnHXyL3HJFAMpucMhTpaaq XZHw== X-Gm-Message-State: AAQBX9cIfwODaCPhofl/6c0D1XQ+rIITCctKiwWu5oTFW702g+bCnRe3 d/bBcX8OAZUil9tXq0ILH51EKr/4DH1l0A== X-Google-Smtp-Source: AKy350Z2u+F5JiR1FqhNCdYJWMSKSee5aZrTwWLa8ky50O595FH3PD7x0SHmghoJbG7JbXmuM+oyHw== X-Received: by 2002:a05:6a00:1a15:b0:63a:d2e4:cc35 with SMTP id g21-20020a056a001a1500b0063ad2e4cc35mr26201375pfv.31.1682495262582; Wed, 26 Apr 2023 00:47:42 -0700 (PDT) Received: from localhost.localdomain ([103.121.155.252]) by smtp.gmail.com with ESMTPSA id fa23-20020a056a002d1700b006259e883ee9sm8845589pfb.189.2023.04.26.00.47.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Apr 2023 00:47:42 -0700 (PDT) From: Omkar Patil To: openembedded-core@lists.openembedded.org, omkar.patil@kpit.com Cc: ranjitsinh.rathod@kpit.com, Nikhil R , Omkar Patil Subject: [OE-core][dunfell][PATCH 1/3] openssl: Fix CVE-2023-0464 Date: Wed, 26 Apr 2023 13:17:21 +0530 Message-Id: <20230426074723.125714-1-omkarpatil10.93@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 26 Apr 2023 07:47:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/180408 From: Nikhil R Fix CVE-2023-0464 for openssl A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service(DoS) attack on affected systems. Link: https://git.openssl.org/gitweb/?p=openssl.git;a=patch;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b Signed-off-by: Nikhil R Signed-off-by: Omkar Patil --- .../openssl/openssl/CVE-2023-0464.patch | 226 ++++++++++++++++++ .../openssl/openssl_1.1.1t.bb | 1 + 2 files changed, 227 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch new file mode 100644 index 0000000000..cce5bad9f0 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch @@ -0,0 +1,226 @@ +From 879f7080d7e141f415c79eaa3a8ac4a3dad0348b Mon Sep 17 00:00:00 2001 +From: Pauli +Date: Wed, 8 Mar 2023 15:28:20 +1100 +Subject: [PATCH] x509: excessive resource use verifying policy constraints + +A security vulnerability has been identified in all supported versions +of OpenSSL related to the verification of X.509 certificate chains +that include policy constraints. Attackers may be able to exploit this +vulnerability by creating a malicious certificate chain that triggers +exponential use of computational resources, leading to a denial-of-service +(DoS) attack on affected systems. + +Fixes CVE-2023-0464 + +Reviewed-by: Tomas Mraz +Reviewed-by: Shane Lontis +(Merged from https://github.com/openssl/openssl/pull/20569) + +CVE: CVE-2023-0464 +Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=patch;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b] +Signed-off-by: Nikhil R + +--- + crypto/x509v3/pcy_local.h | 8 +++++++- + crypto/x509v3/pcy_node.c | 12 +++++++++--- + crypto/x509v3/pcy_tree.c | 37 +++++++++++++++++++++++++++---------- + 3 files changed, 43 insertions(+), 14 deletions(-) + +diff --git a/crypto/x509v3/pcy_local.h b/crypto/x509v3/pcy_local.h +index 5daf78de45..344aa06765 100644 +--- a/crypto/x509v3/pcy_local.h ++++ b/crypto/x509v3/pcy_local.h +@@ -111,6 +111,11 @@ struct X509_POLICY_LEVEL_st { + }; + + struct X509_POLICY_TREE_st { ++ /* The number of nodes in the tree */ ++ size_t node_count; ++ /* The maximum number of nodes in the tree */ ++ size_t node_maximum; ++ + /* This is the tree 'level' data */ + X509_POLICY_LEVEL *levels; + int nlevel; +@@ -159,7 +164,8 @@ X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk, + X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level, + X509_POLICY_DATA *data, + X509_POLICY_NODE *parent, +- X509_POLICY_TREE *tree); ++ X509_POLICY_TREE *tree, ++ int extra_data); + void policy_node_free(X509_POLICY_NODE *node); + int policy_node_match(const X509_POLICY_LEVEL *lvl, + const X509_POLICY_NODE *node, const ASN1_OBJECT *oid); +diff --git a/crypto/x509v3/pcy_node.c b/crypto/x509v3/pcy_node.c +index e2d7b15322..d574fb9d66 100644 +--- a/crypto/x509v3/pcy_node.c ++++ b/crypto/x509v3/pcy_node.c +@@ -59,10 +59,15 @@ X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level, + X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level, + X509_POLICY_DATA *data, + X509_POLICY_NODE *parent, +- X509_POLICY_TREE *tree) ++ X509_POLICY_TREE *tree, ++ int extra_data) + { + X509_POLICY_NODE *node; + ++ /* Verify that the tree isn't too large. This mitigates CVE-2023-0464 */ ++ if (tree->node_maximum > 0 && tree->node_count >= tree->node_maximum) ++ return NULL; ++ + node = OPENSSL_zalloc(sizeof(*node)); + if (node == NULL) { + X509V3err(X509V3_F_LEVEL_ADD_NODE, ERR_R_MALLOC_FAILURE); +@@ -70,7 +75,7 @@ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level, + } + node->data = data; + node->parent = parent; +- if (level) { ++ if (level != NULL) { + if (OBJ_obj2nid(data->valid_policy) == NID_any_policy) { + if (level->anyPolicy) + goto node_error; +@@ -90,7 +95,7 @@ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level, + } + } + +- if (tree) { ++ if (extra_data) { + if (tree->extra_data == NULL) + tree->extra_data = sk_X509_POLICY_DATA_new_null(); + if (tree->extra_data == NULL){ +@@ -103,6 +108,7 @@ X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level, + } + } + ++ tree->node_count++; + if (parent) + parent->nchild++; + +diff --git a/crypto/x509v3/pcy_tree.c b/crypto/x509v3/pcy_tree.c +index 6e8322cbc5..6c7fd35405 100644 +--- a/crypto/x509v3/pcy_tree.c ++++ b/crypto/x509v3/pcy_tree.c +@@ -13,6 +13,18 @@ + + #include "pcy_local.h" + ++/* ++ * If the maximum number of nodes in the policy tree isn't defined, set it to ++ * a generous default of 1000 nodes. ++ * ++ * Defining this to be zero means unlimited policy tree growth which opens the ++ * door on CVE-2023-0464. ++ */ ++ ++#ifndef OPENSSL_POLICY_TREE_NODES_MAX ++# define OPENSSL_POLICY_TREE_NODES_MAX 1000 ++#endif ++ + /* + * Enable this to print out the complete policy tree at various point during + * evaluation. +@@ -168,6 +180,9 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, + return X509_PCY_TREE_INTERNAL; + } + ++ /* Limit the growth of the tree to mitigate CVE-2023-0464 */ ++ tree->node_maximum = OPENSSL_POLICY_TREE_NODES_MAX; ++ + /* + * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3. + * +@@ -184,7 +199,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, + level = tree->levels; + if ((data = policy_data_new(NULL, OBJ_nid2obj(NID_any_policy), 0)) == NULL) + goto bad_tree; +- if (level_add_node(level, data, NULL, tree) == NULL) { ++ if (level_add_node(level, data, NULL, tree, 1) == NULL) { + policy_data_free(data); + goto bad_tree; + } +@@ -243,7 +258,8 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, + * Return value: 1 on success, 0 otherwise + */ + static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr, +- X509_POLICY_DATA *data) ++ X509_POLICY_DATA *data, ++ X509_POLICY_TREE *tree) + { + X509_POLICY_LEVEL *last = curr - 1; + int i, matched = 0; +@@ -253,13 +269,13 @@ static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr, + X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i); + + if (policy_node_match(last, node, data->valid_policy)) { +- if (level_add_node(curr, data, node, NULL) == NULL) ++ if (level_add_node(curr, data, node, tree, 0) == NULL) + return 0; + matched = 1; + } + } + if (!matched && last->anyPolicy) { +- if (level_add_node(curr, data, last->anyPolicy, NULL) == NULL) ++ if (level_add_node(curr, data, last->anyPolicy, tree, 0) == NULL) + return 0; + } + return 1; +@@ -272,7 +288,8 @@ static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr, + * Return value: 1 on success, 0 otherwise. + */ + static int tree_link_nodes(X509_POLICY_LEVEL *curr, +- const X509_POLICY_CACHE *cache) ++ const X509_POLICY_CACHE *cache, ++ X509_POLICY_TREE *tree) + { + int i; + +@@ -280,7 +297,7 @@ static int tree_link_nodes(X509_POLICY_LEVEL *curr, + X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i); + + /* Look for matching nodes in previous level */ +- if (!tree_link_matching_nodes(curr, data)) ++ if (!tree_link_matching_nodes(curr, data, tree)) + return 0; + } + return 1; +@@ -311,7 +328,7 @@ static int tree_add_unmatched(X509_POLICY_LEVEL *curr, + /* Curr may not have anyPolicy */ + data->qualifier_set = cache->anyPolicy->qualifier_set; + data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS; +- if (level_add_node(curr, data, node, tree) == NULL) { ++ if (level_add_node(curr, data, node, tree, 1) == NULL) { + policy_data_free(data); + return 0; + } +@@ -373,7 +390,7 @@ static int tree_link_any(X509_POLICY_LEVEL *curr, + } + /* Finally add link to anyPolicy */ + if (last->anyPolicy && +- level_add_node(curr, cache->anyPolicy, last->anyPolicy, NULL) == NULL) ++ level_add_node(curr, cache->anyPolicy, last->anyPolicy, tree, 0) == NULL) + return 0; + return 1; + } +@@ -555,7 +572,7 @@ static int tree_calculate_user_set(X509_POLICY_TREE *tree, + extra->qualifier_set = anyPolicy->data->qualifier_set; + extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS + | POLICY_DATA_FLAG_EXTRA_NODE; +- node = level_add_node(NULL, extra, anyPolicy->parent, tree); ++ node = level_add_node(NULL, extra, anyPolicy->parent, tree, 1); + } + if (!tree->user_policies) { + tree->user_policies = sk_X509_POLICY_NODE_new_null(); +@@ -582,7 +599,7 @@ static int tree_evaluate(X509_POLICY_TREE *tree) + + for (i = 1; i < tree->nlevel; i++, curr++) { + cache = policy_cache_set(curr->cert); +- if (!tree_link_nodes(curr, cache)) ++ if (!tree_link_nodes(curr, cache, tree)) + return X509_PCY_TREE_INTERNAL; + + if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY) +-- +2.34.1 diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb index a1956ad8c2..94cb458508 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb @@ -18,6 +18,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://afalg.patch \ file://reproducible.patch \ file://reproducibility.patch \ + file://CVE-2023-0464.patch \ " SRC_URI_append_class-nativesdk = " \ From patchwork Wed Apr 26 07:47:22 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omkar Patil X-Patchwork-Id: 23006 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39994C7618E for ; Wed, 26 Apr 2023 07:47:57 +0000 (UTC) Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by mx.groups.io with SMTP id smtpd.web11.2621.1682495267814037999 for ; Wed, 26 Apr 2023 00:47:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20221208 header.b=QPwMZL+f; spf=pass (domain: gmail.com, ip: 209.85.210.176, mailfrom: omkarpatil10.93@gmail.com) Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-63b35789313so4918158b3a.3 for ; Wed, 26 Apr 2023 00:47:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682495267; x=1685087267; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=CT2lqoPrp/M6J2RCqBzfBh0SuAfeMYuTV86Up/ghjwY=; b=QPwMZL+fi3TacR5lNO2+wvtL0dRAl8rtdo2TJaxP7kwpwYLpAdpeSLFIL6qz/7egKY Bm+IQ6BTrmk5MPKmNDmtHWn6iMinoYfz9yvWF/et4wpLyvF4UH3UcezEttm6W5qhWdiV 9MmhqUcOxBGzicKU+zlnDlikeKusSB/FJ5KzNpKzReVI3vRA1IgMYkqAw++7WQblxGEJ rgMnXbYmw3+HzHiX5k1I1+8meGeGzdcyOwKwMwLe4cvieiI1R3s96xtcpXD+xtN0E1eo 0A3Bky/fcHbnMS0T+0DIXMparelJf0xYE/6me9QzKElz+/gad3s7HqhwZnkCIoYfXv1G 65eA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682495267; x=1685087267; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=CT2lqoPrp/M6J2RCqBzfBh0SuAfeMYuTV86Up/ghjwY=; b=L5+5M76wRN6v4rwNPtW0qG7G52jGMtMUMk4A35lEtB8fX23kFvtOOPew+ZztbOv3XS 9xavqlSI47GsXRRKa1JvQTGsAn0vwzusyoxvm6W4w1Psw/5lfVxxRMg+1XZ28c4RR4SD iD9HRO4E5ghTXDTrAUYJbrlJpqxtx6Yl/rltsfpqxhk1AK0xSnUJwDGSGSF6dPthYr+C Ub9mI/IlKE52PJA+4H57ApJkZU+9Rw2+pCtp2q6lYt9ZlrsjxfMYLfd+8KjnirEflJCn iUZgmmdtW48Dj0vPzmabrpC6iqAJY5Pcm+bUsz0v5oAZKoTcgpHIX18plxAOgM5kArtk sOSA== X-Gm-Message-State: AAQBX9dQv6GiUhT/0GvpMSYauEITUtjeDDOOztrZEjyCtxk5VljKZpfh NLDVJwaN53QX05BrmqK5AMEleefVZ+Jn6g== X-Google-Smtp-Source: AKy350Z8dKlxaPCyE1s+Y6nBjLAFZRusHsh4Q9R/91Ehifm05bfdAE75ZKBoyP2Efjkqd6JgGs1OOg== X-Received: by 2002:a05:6a00:1a04:b0:63b:5c82:e21a with SMTP id g4-20020a056a001a0400b0063b5c82e21amr26921049pfv.1.1682495267094; Wed, 26 Apr 2023 00:47:47 -0700 (PDT) Received: from localhost.localdomain ([103.121.155.252]) by smtp.gmail.com with ESMTPSA id fa23-20020a056a002d1700b006259e883ee9sm8845589pfb.189.2023.04.26.00.47.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Apr 2023 00:47:46 -0700 (PDT) From: Omkar Patil To: openembedded-core@lists.openembedded.org, omkar.patil@kpit.com Cc: ranjitsinh.rathod@kpit.com, Omkar Patil Subject: [OE-core][dunfell][PATCH 2/3] openssl: Fix CVE-2023-0465 Date: Wed, 26 Apr 2023 13:17:22 +0530 Message-Id: <20230426074723.125714-2-omkarpatil10.93@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230426074723.125714-1-omkarpatil10.93@gmail.com> References: <20230426074723.125714-1-omkarpatil10.93@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 26 Apr 2023 07:47:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/180409 From: Omkar Patil Add patch to fix CVE-2023-0465 Link: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95 Signed-off-by: Omkar Patil Signed-off-by: Omkar Patil --- .../openssl/openssl/CVE-2023-0465.patch | 60 +++++++++++++++++++ .../openssl/openssl_1.1.1t.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0465.patch diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2023-0465.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0465.patch new file mode 100644 index 0000000000..be5068074e --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0465.patch @@ -0,0 +1,60 @@ +From b013765abfa80036dc779dd0e50602c57bb3bf95 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Tue, 7 Mar 2023 16:52:55 +0000 +Subject: [PATCH] Ensure that EXFLAG_INVALID_POLICY is checked even in leaf + certs + +Even though we check the leaf cert to confirm it is valid, we +later ignored the invalid flag and did not notice that the leaf +cert was bad. + +Fixes: CVE-2023-0465 + +Reviewed-by: Hugo Landau +Reviewed-by: Tomas Mraz +(Merged from https://github.com/openssl/openssl/pull/20588) + +CVE: CVE-2023-0465 +Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95] +Comment: Refreshed first hunk +Signed-off-by: Omkar Patil + +--- + crypto/x509/x509_vfy.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c +index 925fbb5412..1dfe4f9f31 100644 +--- a/crypto/x509/x509_vfy.c ++++ b/crypto/x509/x509_vfy.c +@@ -1649,18 +1649,25 @@ + } + /* Invalid or inconsistent extensions */ + if (ret == X509_PCY_TREE_INVALID) { +- int i; ++ int i, cbcalled = 0; + + /* Locate certificates with bad extensions and notify callback. */ +- for (i = 1; i < sk_X509_num(ctx->chain); i++) { ++ for (i = 0; i < sk_X509_num(ctx->chain); i++) { + X509 *x = sk_X509_value(ctx->chain, i); + + if (!(x->ex_flags & EXFLAG_INVALID_POLICY)) + continue; ++ cbcalled = 1; + if (!verify_cb_cert(ctx, x, i, + X509_V_ERR_INVALID_POLICY_EXTENSION)) + return 0; + } ++ if (!cbcalled) { ++ /* Should not be able to get here */ ++ X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR); ++ return 0; ++ } ++ /* The callback ignored the error so we return success */ + return 1; + } + if (ret == X509_PCY_TREE_FAILURE) { +-- +2.34.1 + diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb index 94cb458508..254cc9bc8d 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb @@ -19,6 +19,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://reproducible.patch \ file://reproducibility.patch \ file://CVE-2023-0464.patch \ + file://CVE-2023-0465.patch \ " SRC_URI_append_class-nativesdk = " \ From patchwork Wed Apr 26 07:47:23 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omkar Patil X-Patchwork-Id: 23007 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39DBBC77B78 for ; Wed, 26 Apr 2023 07:47:57 +0000 (UTC) Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by mx.groups.io with SMTP id smtpd.web10.2649.1682495272329777637 for ; Wed, 26 Apr 2023 00:47:52 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="signature has expired" header.i=@gmail.com header.s=20221208 header.b=S1COF9tI; spf=pass (domain: gmail.com, ip: 209.85.210.182, mailfrom: omkarpatil10.93@gmail.com) Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-63b5465fc13so5398115b3a.3 for ; Wed, 26 Apr 2023 00:47:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682495271; x=1685087271; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=no1JO+vKtH4vjstBkntgTJCzC40+uegIJjyjVFNAoVg=; b=S1COF9tIiQlsebUTKp1GxU/SGRjZCy1OzcXfIC6LhB44XcKaOPkJLq637q+5hP5S+F 6NMPMLieOGUrR3oUM9Nr5ciXe0KFKcwtTV5Xeyq+EkNes6e8o/Fe8BRazONmxXwAPaKG ROH6K55t7B92xzNmHAj98hMeOLJ1cb2TV/X2MxOwol61idxnbIS5QwZaED7JWUL9xR6g xY6ruzpAvSLCl10IWkhq5yDpv9QhQLfOyK/LFPoE6Dwh4dC7CsnHaSyAeN9aCoV5tv8u 6X1X9vyBh/DK1VTWKeP5K9xdDjydBbMJ7zt4kLGNLyzWoYcZZZQc1kr4eL7REB9uH1ci ABVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682495271; x=1685087271; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=no1JO+vKtH4vjstBkntgTJCzC40+uegIJjyjVFNAoVg=; b=fsw7Vd/2alwjmje9VQ72njxx90AP/Hh26q9oELABYIcWRcN8gD4t39QyBy7HOZEMBN uxDxqwgk1rAhIM1QZ7mV4khsG2KiLIza5Out4bkAgbdSylyzz+zFyaQuZQ2SvsI22wUX QyX33W67T/bnTAEfoENIPQbFmDJYOP+pTQk1jjPynEilA4ykFcJ7qzaApsotT5fGaa+f SAjNXRkBbvGpaz34r+BJKm7eXxXzs8mn4/+vd7bhrjPVnHu0+sKtY4mu7x4fsm6T2glV aEPK0qPtm7E3q+yK8iqb30ufw/SlMzBMB/UttLSvH0KBmY7ObcdRtXhOPKOcE2ce/J86 5Oqw== X-Gm-Message-State: AAQBX9eTWtsvqmQ80X8VR8rcgrU/O9FNHkyYaBR8POPid9QbwPk9kMUc yj/ZB5V/gwJXOh88wmnaIwhCDB78/ArGNw== X-Google-Smtp-Source: AKy350aB0kLt/dK1J85YZYBC4TZuZIw1yG6KNDHotuUbRmaeggnPSeeyWeKOdbm+STTjcaGv+HkIig== X-Received: by 2002:a05:6a00:2448:b0:63b:7a55:ae89 with SMTP id d8-20020a056a00244800b0063b7a55ae89mr25839748pfj.27.1682495271548; Wed, 26 Apr 2023 00:47:51 -0700 (PDT) Received: from localhost.localdomain ([103.121.155.252]) by smtp.gmail.com with ESMTPSA id fa23-20020a056a002d1700b006259e883ee9sm8845589pfb.189.2023.04.26.00.47.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Apr 2023 00:47:51 -0700 (PDT) From: Omkar Patil To: openembedded-core@lists.openembedded.org, omkar.patil@kpit.com Cc: ranjitsinh.rathod@kpit.com, Omkar Patil Subject: [OE-core][dunfell][PATCH 3/3] openssl: Fix CVE-2023-0466 Date: Wed, 26 Apr 2023 13:17:23 +0530 Message-Id: <20230426074723.125714-3-omkarpatil10.93@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230426074723.125714-1-omkarpatil10.93@gmail.com> References: <20230426074723.125714-1-omkarpatil10.93@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 26 Apr 2023 07:47:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/180410 From: Omkar Patil Add patch to fix CVE-2023-0466 Link: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a Signed-off-by: Omkar Patil Signed-off-by: Omkar Patil --- .../openssl/openssl/CVE-2023-0466.patch | 82 +++++++++++++++++++ .../openssl/openssl_1.1.1t.bb | 1 + 2 files changed, 83 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-0466.patch diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2023-0466.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0466.patch new file mode 100644 index 0000000000..f042aa5da1 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0466.patch @@ -0,0 +1,82 @@ +From 0d16b7e99aafc0b4a6d729eec65a411a7e025f0a Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Tue, 21 Mar 2023 16:15:47 +0100 +Subject: [PATCH] Fix documentation of X509_VERIFY_PARAM_add0_policy() + +The function was incorrectly documented as enabling policy checking. + +Fixes: CVE-2023-0466 + +Reviewed-by: Matt Caswell +Reviewed-by: Paul Dale +(Merged from https://github.com/openssl/openssl/pull/20564) + +CVE: CVE-2023-0466 +Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a] +Comment: Refreshed first hunk from CHANGE and NEWS +Signed-off-by: Omkar Patil + +--- + CHANGES | 5 +++++ + NEWS | 1 + + doc/man3/X509_VERIFY_PARAM_set_flags.pod | 9 +++++++-- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/CHANGES b/CHANGES +index efccf7838e..b19f1429bb 100644 +--- a/CHANGES ++++ b/CHANGES +@@ -9,6 +9,11 @@ + + Changes between 1.1.1s and 1.1.1t [7 Feb 2023] + ++ *) Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention ++ that it does not enable policy checking. Thanks to ++ David Benjamin for discovering this issue. (CVE-2023-0466) ++ [Tomas Mraz] ++ + *) Fixed X.400 address type confusion in X.509 GeneralName. + + There is a type confusion vulnerability relating to X.400 address processing +diff --git a/NEWS b/NEWS +index 36a9bb6890..62615693fa 100644 +--- a/NEWS ++++ b/NEWS +@@ -7,6 +7,7 @@ + + Major changes between OpenSSL 1.1.1s and OpenSSL 1.1.1t [7 Feb 2023] + ++ o Fixed documentation of X509_VERIFY_PARAM_add0_policy() (CVE-2023-0466) + o Fixed X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) + o Fixed Use-after-free following BIO_new_NDEF (CVE-2023-0215) + o Fixed Double free after calling PEM_read_bio_ex (CVE-2022-4450) +diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +index f6f304bf7b..aa292f9336 100644 +--- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod ++++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +@@ -92,8 +92,9 @@ B. + X509_VERIFY_PARAM_set_time() sets the verification time in B to + B. Normally the current time is used. + +-X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled +-by default) and adds B to the acceptable policy set. ++X509_VERIFY_PARAM_add0_policy() adds B to the acceptable policy set. ++Contrary to preexisting documentation of this function it does not enable ++policy checking. + + X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled + by default) and sets the acceptable policy set to B. Any existing +@@ -377,6 +378,10 @@ and has no effect. + + The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. + ++The function X509_VERIFY_PARAM_add0_policy() was historically documented as ++enabling policy checking however the implementation has never done this. ++The documentation was changed to align with the implementation. ++ + =head1 COPYRIGHT + + Copyright 2009-2020 The OpenSSL Project Authors. All Rights Reserved. +-- +2.34.1 + diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb index 254cc9bc8d..46875b525c 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1t.bb @@ -20,6 +20,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://reproducibility.patch \ file://CVE-2023-0464.patch \ file://CVE-2023-0465.patch \ + file://CVE-2023-0466.patch \ " SRC_URI_append_class-nativesdk = " \