rpms/compat-openssl11
7
0
Fork 0
Code Issues Pull Requests Releases Activity

CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify()

Browse Source 
Resolves: RHEL-179635
Signed-off-by: Stepan Broz <sbroz@redhat.com>
This commit is contained in:
Stepan Broz 2026-06-27 22:45:16 +02:00
parent 66101a30f9
commit c646f2ea51
2 changed files with 306 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
compat-openssl11.spec
View File

@ -22,7 +22,7 @@
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: compat-openssl11
Version: 1.1.1k
Release: 5%{?dist}.3
Release: 5%{?dist}.4
Epoch: 1
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
@ -83,6 +83,8 @@ Patch75: openssl-1.1.1-hardening-from-openssl-3.0.1.patch
Patch76: openssl-1.1.1-cve-2025-69419.patch
# Fix for CVE-2026-28390
Patch77: openssl-1.1.1-cve-2026-28390.patch
# Fix for CVE-2026-45447
Patch78: openssl-1.1.1-cve-2026-45447.patch
License: OpenSSL and ASL 2.0
URL: http://www.openssl.org/
@ -116,47 +118,48 @@ releases.
cp %{SOURCE12} crypto/ec/
cp %{SOURCE13} test/
%patch1 -p1 -b .build %{?_rawbuild}
%patch2 -p1 -b .defaults
%patch3 -p1 -b .no-html %{?_rawbuild}
%patch4 -p1 -b .man-rename
%patch -P 1 -p1 -b .build %{?_rawbuild}
%patch -P 2 -p1 -b .defaults
%patch -P 3 -p1 -b .no-html %{?_rawbuild}
%patch -P 4 -p1 -b .man-rename
%patch31 -p1 -b .conf-paths
%patch32 -p1 -b .version-add-engines
%patch33 -p1 -b .dgst
%patch36 -p1 -b .no-brainpool
%patch37 -p1 -b .curves
%patch38 -p1 -b .no-weak-verify
%patch40 -p1 -b .disable-ssl3
%patch41 -p1 -b .system-cipherlist
%patch42 -p1 -b .fips
%patch45 -p1 -b .weak-ciphers
%patch46 -p1 -b .seclevel
%patch47 -p1 -b .ts-sha256-default
%patch48 -p1 -b .fips-post-rand
%patch49 -p1 -b .evp-kdf
%patch50 -p1 -b .ssh-kdf
%patch51 -p1 -b .intel-cet
%patch52 -p1 -b .s390x-update
%patch53 -p1 -b .crng-test
%patch55 -p1 -b .arm-update
%patch56 -p1 -b .s390x-ecc
%patch60 -p1 -b .krb5-kdf
%patch61 -p1 -b .edk2-build
%patch62 -p1 -b .fips-curves
%patch65 -p1 -b .drbg-selftest
%patch66 -p1 -b .fips-dh
%patch67 -p1 -b .kdf-selftest
%patch69 -p1 -b .alpn-cb
%patch70 -p1 -b .rewire-fips-drbg
%patch71 -p1 -b .conf-new
%patch72 -p1 -b .disable-fips
%patch73 -p1 -b .cve-2022-0778
%patch -P 31 -p1 -b .conf-paths
%patch -P 32 -p1 -b .version-add-engines
%patch -P 33 -p1 -b .dgst
%patch -P 36 -p1 -b .no-brainpool
%patch -P 37 -p1 -b .curves
%patch -P 38 -p1 -b .no-weak-verify
%patch -P 40 -p1 -b .disable-ssl3
%patch -P 41 -p1 -b .system-cipherlist
%patch -P 42 -p1 -b .fips
%patch -P 45 -p1 -b .weak-ciphers
%patch -P 46 -p1 -b .seclevel
%patch -P 47 -p1 -b .ts-sha256-default
%patch -P 48 -p1 -b .fips-post-rand
%patch -P 49 -p1 -b .evp-kdf
%patch -P 50 -p1 -b .ssh-kdf
%patch -P 51 -p1 -b .intel-cet
%patch -P 52 -p1 -b .s390x-update
%patch -P 53 -p1 -b .crng-test
%patch -P 55 -p1 -b .arm-update
%patch -P 56 -p1 -b .s390x-ecc
%patch -P 60 -p1 -b .krb5-kdf
%patch -P 61 -p1 -b .edk2-build
%patch -P 62 -p1 -b .fips-curves
%patch -P 65 -p1 -b .drbg-selftest
%patch -P 66 -p1 -b .fips-dh
%patch -P 67 -p1 -b .kdf-selftest
%patch -P 69 -p1 -b .alpn-cb
%patch -P 70 -p1 -b .rewire-fips-drbg
%patch -P 71 -p1 -b .conf-new
%patch -P 72 -p1 -b .disable-fips
%patch -P 73 -p1 -b .cve-2022-0778
%patch -P 83 -p1 -b .replace-expired-certs
%patch74 -p1 -b .cve-2023-0286
%patch75 -p1 -b .cve-2025-69419-1
%patch76 -p1 -b .cve-2025-69419-2
%patch77 -p1 -b .cve-2026-28390
%patch -P 74 -p1 -b .cve-2023-0286
%patch -P 75 -p1 -b .cve-2025-69419-1
%patch -P 76 -p1 -b .cve-2025-69419-2
%patch -P 77 -p1 -b .cve-2026-28390
%patch -P 78 -p1 -b .cve-2026-45447
cp apps/openssl.cnf apps/openssl11.cnf
%build
@ -324,6 +327,9 @@ install -m 644 apps/openssl11.cnf $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl1
%ldconfig_scriptlets
%changelog
* Fri Jun 26 2026 Stepan Broz <sbroz@redhat.com> - 1:1.1.1k-5.4
- Fixes CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify()
* Wed May 13 2026 Pavol Žáčik <pzacik@redhat.com> - 1:1.1.1k-5.3
- Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Resolves: RHEL-165863

260
openssl-1.1.1-cve-2026-45447.patch Normal file
View File

@ -0,0 +1,260 @@
From 4ae990ae9c7f47ac214527dc5685e5df0c82d6b9 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <beldmit@gmail.com>
Date: Tue, 2 Jun 2026 14:55:02 +0200
Subject: [PATCH] Fix double-free of caller-owned BIO in PKCS7_verify
When PKCS7_dataInit creates no filter BIOs (e.g. empty digestAlgorithms
SET), it returns p7bio pointing directly to the caller's indata BIO.
The cleanup code in PKCS7_verify then frees indata via BIO_free_all(p7bio),
leaving the caller with a dangling pointer and causing a double-free
when the caller frees its own BIO.
Guard BIO_free_all with a check that p7bio is not the caller's indata BIO.
Add a regression test using a crafted S/MIME message with an empty
digestAlgorithms SET to verify the fix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
crypto/pkcs7/pk7_smime.c | 5 +-
test/build.info | 7 +-
test/pkcs7_verify_test.c | 104 ++++++++++++++++++
test/recipes/25-test_pkcs7_verify.t | 20 ++++
.../pkcs7-empty-digest-set.eml | 45 ++++++++
5 files changed, 179 insertions(+), 2 deletions(-)
create mode 100644 test/pkcs7_verify_test.c
create mode 100644 test/recipes/25-test_pkcs7_verify.t
create mode 100644 test/recipes/25-test_pkcs7_verify_data/pkcs7-empty-digest-set.eml
diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
index a95db62178..3e3ceda3cf 100644
--- a/crypto/pkcs7/pk7_smime.c
+++ b/crypto/pkcs7/pk7_smime.c
@@ -363,8 +363,11 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
if (tmpin == indata) {
if (indata)
BIO_pop(p7bio);
+ if (p7bio != indata)
+ BIO_free_all(p7bio);
+ } else {
+ BIO_free_all(p7bio);
}
- BIO_free_all(p7bio);
sk_X509_free(signers);
return ret;
}
diff --git a/test/build.info b/test/build.info
index 6357a7f2fe..648be6bbfc 100644
--- a/test/build.info
+++ b/test/build.info
@@ -51,7 +51,8 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
recordlentest drbgtest drbg_cavs_test sslbuffertest \
time_offset_test pemtest ssl_cert_table_internal_test ciphername_test \
servername_test ocspapitest rsa_mp_test fatalerrtest tls13ccstest \
- sysdefaulttest errtest ssl_ctx_test gosttest
+ sysdefaulttest errtest ssl_ctx_test gosttest \
+ pkcs7_verify_test
SOURCE[versions]=versions.c
INCLUDE[versions]=../include
@@ -574,6 +575,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
INCLUDE[ssl_ctx_test]=../include
DEPEND[ssl_ctx_test]=../libcrypto ../libssl libtestutil.a
+ SOURCE[pkcs7_verify_test]=pkcs7_verify_test.c
+ INCLUDE[pkcs7_verify_test]=../include
+ DEPEND[pkcs7_verify_test]=../libcrypto libtestutil.a
+
{-
use File::Spec::Functions;
use File::Basename;
diff --git a/test/pkcs7_verify_test.c b/test/pkcs7_verify_test.c
new file mode 100644
index 0000000000..932c2589ae
--- /dev/null
+++ b/test/pkcs7_verify_test.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/pkcs7.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/objects.h>
+#include "testutil.h"
+
+static const char *emlfile;
+
+/*
+ * Regression test for a double-free of the caller-owned indata BIO in
+ * PKCS7_verify. When the PKCS7 digestAlgorithms SET is empty,
+ * PKCS7_dataInit creates no digest filter BIOs and returns p7bio == indata.
+ * The cleanup code then frees the caller's BIO via BIO_free_all(p7bio).
+ *
+ * The test uses a crafted S/MIME message whose PKCS7 signature has an empty
+ * digestAlgorithms SET. The detached content is re-wrapped through a
+ * file-backed BIO to bypass the tmpin memory-BIO optimisation in
+ * PKCS7_verify (which would mask the bug).
+ */
+static int test_pkcs7_verify_empty_md_algs(void)
+{
+ int ret = 0;
+ BIO *bio_eml = NULL;
+ BIO *indata_mem = NULL;
+ BIO *indata = NULL;
+ PKCS7 *p7 = NULL;
+ char *mem_ptr = NULL;
+ long mem_len;
+ FILE *tmpf = NULL;
+
+ if (!TEST_ptr(bio_eml = BIO_new_file(emlfile, "r")))
+ goto err;
+
+ if (!TEST_ptr(p7 = SMIME_read_PKCS7(bio_eml, &indata_mem)))
+ goto err;
+
+ /* Confirm the test data has an empty digestAlgorithms SET */
+ if (!TEST_int_eq(sk_X509_ALGOR_num(p7->d.sign->md_algs), 0))
+ goto err;
+
+ /*
+ * Re-wrap content through a file BIO so BIO_method_type != BIO_TYPE_MEM.
+ * This forces tmpin == indata in PKCS7_verify, hitting the vulnerable path.
+ */
+ mem_len = BIO_get_mem_data(indata_mem, &mem_ptr);
+ if (!TEST_ptr(tmpf = tmpfile()))
+ goto err;
+ if (fwrite(mem_ptr, 1, mem_len, tmpf) != (size_t)mem_len) {
+ fclose(tmpf);
+ TEST_error("failed to write to temp file");
+ goto err;
+ }
+ fflush(tmpf);
+ rewind(tmpf);
+ if (!TEST_ptr(indata = BIO_new_fp(tmpf, BIO_CLOSE))) {
+ fclose(tmpf);
+ goto err;
+ }
+
+ /*
+ * NOVERIFY: skip cert chain validation
+ * NOSIGS: skip signature verification
+ * We only care about the BIO lifecycle, not cryptographic validity.
+ */
+ PKCS7_verify(p7, NULL, NULL, indata, NULL,
+ PKCS7_NOVERIFY | PKCS7_NOSIGS);
+
+ /*
+ * If the bug is present, indata has already been freed by PKCS7_verify.
+ * BIO_free will crash (use-after-free / double-free). Under ASan this
+ * is detected reliably; without ASan it may silently corrupt the heap.
+ */
+ BIO_free(indata);
+ indata = NULL;
+
+ ret = 1;
+
+err:
+ BIO_free(indata);
+ BIO_free(indata_mem);
+ PKCS7_free(p7);
+ BIO_free(bio_eml);
+ return ret;
+}
+
+int setup_tests(void)
+{
+ if (!TEST_ptr(emlfile = test_get_argument(0))) {
+ TEST_note("usage: pkcs7_verify_test <eml-file>");
+ return 0;
+ }
+
+ ADD_TEST(test_pkcs7_verify_empty_md_algs);
+ return 1;
+}
diff --git a/test/recipes/25-test_pkcs7_verify.t b/test/recipes/25-test_pkcs7_verify.t
new file mode 100644
index 0000000000..7666467f8c
--- /dev/null
+++ b/test/recipes/25-test_pkcs7_verify.t
@@ -0,0 +1,20 @@
+#! /usr/bin/env perl
+# Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the OpenSSL license (the "License"). You may not use
+# this file except in compliance with the License. You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use strict;
+use warnings;
+
+use OpenSSL::Test qw/:DEFAULT data_file/;
+
+setup("test_pkcs7_verify");
+
+plan tests => 1;
+
+ok(run(test(["pkcs7_verify_test",
+ data_file("pkcs7-empty-digest-set.eml")])),
+ "PKCS7_verify with empty digestAlgorithms does not double-free indata");
diff --git a/test/recipes/25-test_pkcs7_verify_data/pkcs7-empty-digest-set.eml b/test/recipes/25-test_pkcs7_verify_data/pkcs7-empty-digest-set.eml
new file mode 100644
index 0000000000..a6db2c38ad
--- /dev/null
+++ b/test/recipes/25-test_pkcs7_verify_data/pkcs7-empty-digest-set.eml
@@ -0,0 +1,45 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----E0314CC5D732C92AE2D7A3BACDCDCFCE"
+
+This is an S/MIME signed message
+
+------E0314CC5D732C92AE2D7A3BACDCDCFCE
+This is the content to be signed.
+
+------E0314CC5D732C92AE2D7A3BACDCDCFCE
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIFWgYJKoZIhvcNAQcCoIIFSzCCBUcCAQExADALBgkqhkiG9w0BBwGgggLuMIIC
+6jCCAdKgAwIBAgIUL5E46FxyhsT7C3G1NS27OtR7XAowDQYJKoZIhvcNAQELBQAw
+FTETMBEGA1UEAwwKUG9DIFNpZ25lcjAeFw0yNjA1MDgxMDIwNDhaFw0yNzA1MDgx
+MDIwNDhaMBUxEzARBgNVBAMMClBvQyBTaWduZXIwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQDSSu/gupmIlclvmTMHiqOrCqmB8NRTjAMoI//MPJrnFXYp
+FjDPMk7Y/kCcHztudaIvADkowaFtOm4oMinQFhjwCNCo5K5WrrlAitnpcd5QH2nA
+iVZXjjohQUJEd7n33AGqTwo5EGaCK+alAZL7tA7bdhNi/aZ33L3bUNYqoHbXiNsE
+u1tj8frLfIjduOt0TMPSOrrFjjEsrL3T3tg+HmxpalDHz7E6o9zJu0wlk8bcR2Xk
+mpX8RdYCu7K9m39N1F2WKa9WJh24NQLpWRfwD213jaIFK2EXy/XHePDUeiMYtVOV
+oovCSmY7OqowupA7J+4dcsnRjFqgZECctHhAfk+PAgMBAAGjMjAwMB0GA1UdDgQW
+BBRZlupXNYq4fny0SE76sr/CdQ2DUTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4IBAQANOlttTWVz620JNTrPzhiR4x9+5UiF4GSqv8BRJQFj3Xh7fsUp
++3GDs9M27f4FVh3utJsjt7Sa9ZWLpBVdgjGBwGLAtPsoYMjhnUgZTUvwEk5+aXyv
+zJxn4I7mMbDhlNCMHcVtGdtA+2UOEuvdGfuEilpzPsV8DzM1K3xU5bSWoo0BRFKK
+srHkyEfxCFPAQOcX80ZbMO6zdcXeJjC6mQXGqy2aqeQob0vuSZJ7QHZBlRjY5YHR
+wWlIqG8G3Eist16iTqdX2PQFZT1/QAEQ/LnXARTUUjUroccdci8YNASoeHDpcjRL
+MBrN+QBNZVt5qLhDogwZb2ZwqKfZ8Aqg3oAkMYICPzCCAjsCAQEwLTAVMRMwEQYD
+VQQDDApQb0MgU2lnbmVyAhQvkTjoXHKGxPsLcbU1Lbs61HtcCjANBglghkgBZQME
+AgEFAKCB5DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP
+Fw0yNjA1MDgxMDIwNDhaMC8GCSqGSIb3DQEJBDEiBCAvyoHfycLqb8UzVPizy1uA
+o3h7tza3HebeiJaSnpIJHzB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjAL
+BglghkgBZQMEARYwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMC
+AgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkq
+hkiG9w0BAQEFAASCAQBIpl7U2j4YiU1vdZHyx2dCK41ZahtTVOB4RVJcrmopgans
+fICdkSTfb0dVqc13++bYn4i1b2R2os5YIkoGxdrM5aZB7KF9r1xwgrendTF4/BwP
+gQq2khNtKebv9Yr0kOPynFIsgx5BHk99wrzfwidJUFuJJgQ9W0YOf7EGkbnZvPT+
+hV0aeLmJAb5jjWhbDciqUjR3O23JQhzVj4U3vo2TeN7VYmNJsX+fA4sZzIbYSei9
+ps7GZruiRcKgqgUj1l8HjIGMHqd9lccchk/BYyAGxAbgGisntvfJdPZO09wG8rHh
+eS6FYkkXAKBO49WbhE9aVLJH0zgA6gTfyEvOOOS1
+
+------E0314CC5D732C92AE2D7A3BACDCDCFCE--
+
--
2.54.0