From 0ed23c1a0adca786211624bd0041d2a089f0c8f6 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Mon, 7 Dec 2015 16:57:07 -0800 Subject: openssl: fix for CVE-2015-3194 (From OE-Core rev: edff5fc629c8f70191bd33c731084e8217780a38) Signed-off-by: Armin Kuster Signed-off-by: Joshua Lock Signed-off-by: Richard Purdie --- .../openssl/0001-Add-test-for-CVE-2015-3194.patch | 66 ++++++++++++++++++++++ .../CVE-2015-3194-1-Add-PSS-parameter-check.patch | 45 +++++++++++++++ .../recipes-connectivity/openssl/openssl_1.0.2d.bb | 2 + 3 files changed, 113 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Add-test-for-CVE-2015-3194.patch create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3194-1-Add-PSS-parameter-check.patch diff --git a/meta/recipes-connectivity/openssl/openssl/0001-Add-test-for-CVE-2015-3194.patch b/meta/recipes-connectivity/openssl/openssl/0001-Add-test-for-CVE-2015-3194.patch new file mode 100644 index 0000000..39a2e5a --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/0001-Add-test-for-CVE-2015-3194.patch @@ -0,0 +1,66 @@ +From 00456fded43eadd4bb94bf675ae4ea5d158a764f Mon Sep 17 00:00:00 2001 +From: "Dr. Stephen Henson" +Date: Wed, 4 Nov 2015 13:30:03 +0000 +Subject: [PATCH] Add test for CVE-2015-3194 + +Reviewed-by: Richard Levitte + +Upstream-Status: Backport + +This patch was imported from +https://git.openssl.org/?p=openssl.git;a=commit;h=00456fded43eadd4bb94bf675ae4ea5d158a764f +Signed-off-by: Armin Kuster + +--- + test/certs/pss1.pem | 21 +++++++++++++++++++++ + test/tx509 | 7 +++++++ + 2 files changed, 28 insertions(+) + create mode 100644 test/certs/pss1.pem + +diff --git a/test/certs/pss1.pem b/test/certs/pss1.pem +new file mode 100644 +index 0000000..29da71d +--- /dev/null ++++ b/test/certs/pss1.pem +@@ -0,0 +1,21 @@ ++-----BEGIN CERTIFICATE----- ++MIIDdjCCAjqgAwIBAgIJANcwZLyfEv7DMD4GCSqGSIb3DQEBCjAxoA0wCwYJYIZI ++AWUDBAIBoRowGAYJKoZIhvcNAQEIMAsGCWCGSAFlAwQCAaIEAgIA3jAnMSUwIwYD ++VQQDDBxUZXN0IEludmFsaWQgUFNTIGNlcnRpZmljYXRlMB4XDTE1MTEwNDE2MDIz ++NVoXDTE1MTIwNDE2MDIzNVowJzElMCMGA1UEAwwcVGVzdCBJbnZhbGlkIFBTUyBj ++ZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMTaM7WH ++qVCAGAIA+zL1KWvvASTrhlq+1ePdO7wsrWX2KiYoTYrJYTnxhLnn0wrHqApt79nL ++IBG7cfShyZqFHOY/IzlYPMVt+gPo293gw96Fds5JBsjhjkyGnOyr9OUntFqvxDbT ++IIFU7o9IdxD4edaqjRv+fegVE+B79pDk4s0ujsk6dULtCg9Rst0ucGFo19mr+b7k ++dbfn8pZ72ZNDJPueVdrUAWw9oll61UcYfk75XdrLk6JlL41GrYHc8KlfXf43gGQq ++QfrpHkg4Ih2cI6Wt2nhFGAzrlcorzLliQIUJRIhM8h4IgDfpBpaPdVQLqS2pFbXa ++5eQjqiyJwak2vJ8CAwEAAaNQME4wHQYDVR0OBBYEFCt180N4oGUt5LbzBwQ4Ia+2 ++4V97MB8GA1UdIwQYMBaAFCt180N4oGUt5LbzBwQ4Ia+24V97MAwGA1UdEwQFMAMB ++Af8wMQYJKoZIhvcNAQEKMCSgDTALBglghkgBZQMEAgGhDTALBgkqhkiG9w0BAQii ++BAICAN4DggEBAAjBtm90lGxgddjc4Xu/nbXXFHVs2zVcHv/mqOZoQkGB9r/BVgLb ++xhHrFZ2pHGElbUYPfifdS9ztB73e1d4J+P29o0yBqfd4/wGAc/JA8qgn6AAEO/Xn ++plhFeTRJQtLZVl75CkHXgUGUd3h+ADvKtcBuW9dSUncaUrgNKR8u/h/2sMG38RWY ++DzBddC/66YTa3r7KkVUfW7yqRQfELiGKdcm+bjlTEMsvS+EhHup9CzbpoCx2Fx9p ++NPtFY3yEObQhmL1JyoCRWqBE75GzFPbRaiux5UpEkns+i3trkGssZzsOuVqHNTNZ ++lC9+9hPHIoc9UMmAQNo1vGIW3NWVoeGbaJ8= ++-----END CERTIFICATE----- +diff --git a/test/tx509 b/test/tx509 +index 0ce3b52..77f5cac 100644 +--- a/test/tx509 ++++ b/test/tx509 +@@ -74,5 +74,12 @@ if [ $? != 0 ]; then exit 1; fi + cmp x509-f.p x509-ff.p3 + if [ $? != 0 ]; then exit 1; fi + ++echo "Parsing test certificates" ++ ++$cmd -in certs/pss1.pem -text -noout >/dev/null ++if [ $? != 0 ]; then exit 1; fi ++ ++echo OK ++ + /bin/rm -f x509-f.* x509-ff.* x509-fff.* + exit 0 +-- +2.3.5 + diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2015-3194-1-Add-PSS-parameter-check.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2015-3194-1-Add-PSS-parameter-check.patch new file mode 100644 index 0000000..13d4891 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2015-3194-1-Add-PSS-parameter-check.patch @@ -0,0 +1,45 @@ +From c394a488942387246653833359a5c94b5832674e Mon Sep 17 00:00:00 2001 +From: "Dr. Stephen Henson" +Date: Fri, 2 Oct 2015 12:35:19 +0100 +Subject: [PATCH] Add PSS parameter check. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Avoid seg fault by checking mgf1 parameter is not NULL. This can be +triggered during certificate verification so could be a DoS attack +against a client or a server enabling client authentication. + +Thanks to Loïc Jonas Etienne (Qnective AG) for discovering this bug. + +CVE-2015-3194 + +Reviewed-by: Richard Levitte + +Upstream-Status: Backport + +This patch was imported from +https://git.openssl.org/?p=openssl.git;a=commit;h=c394a488942387246653833359a5c94b5832674e + +Signed-off-by: Armin Kuster + +--- + crypto/rsa/rsa_ameth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/rsa/rsa_ameth.c b/crypto/rsa/rsa_ameth.c +index ca3922e..4e06218 100644 +--- a/crypto/rsa/rsa_ameth.c ++++ b/crypto/rsa/rsa_ameth.c +@@ -268,7 +268,7 @@ static X509_ALGOR *rsa_mgf1_decode(X509_ALGOR *alg) + { + const unsigned char *p; + int plen; +- if (alg == NULL) ++ if (alg == NULL || alg->parameter == NULL) + return NULL; + if (OBJ_obj2nid(alg->algorithm) != NID_mgf1) + return NULL; +-- +2.3.5 + diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2d.bb b/meta/recipes-connectivity/openssl/openssl_1.0.2d.bb index ac78e5c..3aae6a6 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.0.2d.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.0.2d.bb @@ -36,6 +36,8 @@ SRC_URI += "file://configure-targets.patch \ file://run-ptest \ file://crypto_use_bigint_in_x86-64_perl.patch \ file://CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch \ + file://CVE-2015-3194-1-Add-PSS-parameter-check.patch \ + file://0001-Add-test-for-CVE-2015-3194.patch \ " SRC_URI[md5sum] = "38dd619b2e77cbac69b99f52a053d25a" -- cgit v1.1