From ca1ccd862b8b605597a3e4ecd53341f3b157b220 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Thu, 16 Mar 2023 02:11:32 +0000 Subject: [PATCH] Auto sync2gitlab import of gnutls-3.6.16-6.el8_7.src.rpm --- .gitignore | 1 + gnutls-3.6.16.tar.xz.sig | Bin 566 -> 0 bytes gnutls-3.7.8-rsa-kx-timing.patch | 114 +++++++++++++++++++++++++++++++ gnutls.spec | 6 +- sources | 1 + 5 files changed, 120 insertions(+), 2 deletions(-) delete mode 100644 gnutls-3.6.16.tar.xz.sig create mode 100644 gnutls-3.7.8-rsa-kx-timing.patch diff --git a/.gitignore b/.gitignore index f9e9634..fc603d8 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ SOURCES/gnutls-3.6.16.tar.xz SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg /gnutls-3.6.16.tar.xz /gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg +/gnutls-3.6.16.tar.xz.sig diff --git a/gnutls-3.6.16.tar.xz.sig b/gnutls-3.6.16.tar.xz.sig deleted file mode 100644 index 96e702b35e2e66e51ae264f9f35764888d73b8be..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 566 zcmV-60?GY}0y6{v0SEvc79j*iA|=DLZ#0LW$VqJ01%!^*=9qB>0${6WZ~zJk5Y`2R zj@RaxaXFC>|3`|vyrrU2Ltp78#r3?XFEyn#ijOT2D0$PadN!pHN6C3@X%K>b-`lr4 z7J;e%IVpq$4l#phk+a3FHikN)A{kG+)nlj zwR$n|j6+;Z0!JdE2I}(Su^i8r@Siou1$CiSoz1{cNpd*nw}3FedP%5G%*$sddFcC!Nh2B&(HAJoaI7!&l35jX`I@}5;^DrKZTly7T)fzMTunsR&>y_d+z?WE zsc%@;5LTnDokvz~fXM3X3N&$?Yp5GGyypTaAM{ERfVxET2yV$mG^qt6<(&0xM(7DO zPf+4Prl0Ir1tJW$wPtF&?_6KcCGXy}J@x>AN+a?kdt%u5e7l*Azo!eEj@);9}(U9l1_FQ;0%Gw;-Kftah3q6 zXPd<6gR%qnAu(GWsAwZ9K%QMP(mr`4MONJ>Q-T5(S}SrhjZ`C?jD>z6om8`qxF6QW E)) +Date: Tue, 9 Aug 2022 16:05:53 +0200 +Subject: [PATCH 1/2] auth/rsa: side-step potential side-channel + +Remove branching that depends on secret data. + +Signed-off-by: Alexander Sosedkin +Signed-off-by: Hubert Kario +Tested-by: Hubert Kario +--- + lib/auth/rsa.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c +index 8108ee841d..6b158bacb2 100644 +--- a/lib/auth/rsa.c ++++ b/lib/auth/rsa.c +@@ -155,7 +155,6 @@ static int + proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + size_t _data_size) + { +- const char attack_error[] = "auth_rsa: Possible PKCS #1 attack\n"; + gnutls_datum_t ciphertext; + int ret, dsize; + ssize_t data_size = _data_size; +@@ -235,15 +234,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + ok &= CONSTCHECK_NOT_EQUAL(check_ver_min, 0) & + CONSTCHECK_EQUAL(session->key.key.data[1], ver_min); + +- if (ok) { +- /* call logging function unconditionally so all branches are +- * indistinguishable for timing and cache access when debug +- * logging is disabled */ +- _gnutls_no_log("%s", attack_error); +- } else { +- _gnutls_debug_log("%s", attack_error); +- } +- + /* This is here to avoid the version check attack + * discussed above. + */ +-- +2.39.1 + + +From 7c963102ec2119eecc1789b993aabe5edfd75f3b Mon Sep 17 00:00:00 2001 +From: Hubert Kario +Date: Wed, 8 Feb 2023 14:32:09 +0100 +Subject: [PATCH 2/2] rsa: remove dead code + +since the `ok` variable isn't used any more, we can remove all code +used to calculate it + +Signed-off-by: Hubert Kario +--- + lib/auth/rsa.c | 20 +++----------------- + 1 file changed, 3 insertions(+), 17 deletions(-) + +diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c +index 6b158bacb2..858701fe6e 100644 +--- a/lib/auth/rsa.c ++++ b/lib/auth/rsa.c +@@ -159,8 +159,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + int ret, dsize; + ssize_t data_size = _data_size; + volatile uint8_t ver_maj, ver_min; +- volatile uint8_t check_ver_min; +- volatile uint32_t ok; + + #ifdef ENABLE_SSL3 + if (get_num_version(session) == GNUTLS_SSL3) { +@@ -186,7 +184,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + + ver_maj = _gnutls_get_adv_version_major(session); + ver_min = _gnutls_get_adv_version_minor(session); +- check_ver_min = (session->internals.allow_wrong_pms == 0); + + session->key.key.data = gnutls_malloc(GNUTLS_MASTER_SIZE); + if (session->key.key.data == NULL) { +@@ -205,10 +202,9 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + return ret; + } + +- ret = +- gnutls_privkey_decrypt_data2(session->internals.selected_key, +- 0, &ciphertext, session->key.key.data, +- session->key.key.size); ++ gnutls_privkey_decrypt_data2(session->internals.selected_key, ++ 0, &ciphertext, session->key.key.data, ++ session->key.key.size); + /* After this point, any conditional on failure that cause differences + * in execution may create a timing or cache access pattern side + * channel that can be used as an oracle, so treat very carefully */ +@@ -224,16 +220,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, + * Vlastimil Klima, Ondej Pokorny and Tomas Rosa. + */ + +- /* ok is 0 in case of error and 1 in case of success. */ +- +- /* if ret < 0 */ +- ok = CONSTCHECK_EQUAL(ret, 0); +- /* session->key.key.data[0] must equal ver_maj */ +- ok &= CONSTCHECK_EQUAL(session->key.key.data[0], ver_maj); +- /* if check_ver_min then session->key.key.data[1] must equal ver_min */ +- ok &= CONSTCHECK_NOT_EQUAL(check_ver_min, 0) & +- CONSTCHECK_EQUAL(session->key.key.data[1], ver_min); +- + /* This is here to avoid the version check attack + * discussed above. + */ +-- +2.39.1 + diff --git a/gnutls.spec b/gnutls.spec index 2391c51..d44e573 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -10,6 +10,7 @@ Patch13: gnutls-3.6.16-trust-ca-sha1.patch Patch14: gnutls-3.6.16-doc-p11tool-ckaid.patch Patch15: gnutls-3.6.16-pkcs7-verify.patch Patch16: gnutls-3.6.16-cpuid.patch +Patch17: gnutls-3.7.8-rsa-kx-timing.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -294,8 +295,9 @@ fi %endif %changelog -* Mon Dec 19 2022 Daiki Ueno - 3.6.16-6 -- Fix x86_64 CPU feature detection when AVX is not available (#2116610) +* Thu Feb 23 2023 Zoltan Fridrich - 3.6.16-6 +- Fix x86_64 CPU feature detection when AVX is not available (#2131152) +- Fix timing side-channel in TLS RSA key exchange (#2162598) * Mon Aug 29 2022 Daiki Ueno - 3.6.16-5 - Fix double-free in gnutls_pkcs7_verify (#2109788) diff --git a/sources b/sources index d1467c0..cdfd08d 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (gnutls-3.6.16.tar.xz) = 72c78d7fcb024393c1d15f2a1856608ae4460ba43cc5bbbb4c29b80508cae6cb822df4638029de2363437d110187e0a3cc19a7288c3b2f44b2f648399a028438 +SHA512 (gnutls-3.6.16.tar.xz.sig) = 1345c94efd8cbcc5df334ba685d0e5f9b87287888f392d14698c8eadbc07a57cc2f34f82e9298e9539636dde6f2cb25fca414972e5f5090e553808ba4d7c9c23 SHA512 (gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg) = a74b92826fd0e5388c9f6d9231959e38b26aeef83138648fab66df951d8e1a4db5302b569d08515d4d6443e5e4f6c466f98319f330c820790260d22a9b9f7173