rpms/libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2024-3652

Browse Source 
Resolves: RHEL-32483
Signed-off-by: Daiki Ueno <dueno@redhat.com>
This commit is contained in:
Daiki Ueno 2024-06-05 16:52:11 +09:00
parent 75c01c300b
commit 9d65c77b17
2 changed files with 97 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
libreswan-4.12-ikev1-compute-keymat-default.patch Normal file
View File

@ -0,0 +1,92 @@
From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Wed, 27 Mar 2024 10:43:19 -0400
Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
handled ESP algorithms
---
programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
1 file changed, 16 insertions(+), 25 deletions(-)
diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
index 81c522c148..22c346afb4 100644
--- a/programs/pluto/ikev1_quick.c
+++ b/programs/pluto/ikev1_quick.c
@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
* RFC 2409 "IKE" section 5.5
* specifies how this is to be done.
*/
-static void compute_proto_keymat(struct state *st,
+static bool compute_proto_keymat(struct state *st,
uint8_t protoid,
struct ipsec_proto_info *pi,
const char *satypename)
@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
}
break;
- case ESP_CAST:
- case ESP_TWOFISH:
- case ESP_SERPENT:
- /* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
-
default:
- /* bytes */
- needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
- if (needed_len > 0) {
- /* XXX: check key_len coupling with kernel.c's */
- if (pi->attrs.transattrs.enckeylen) {
- needed_len =
- pi->attrs.transattrs.enckeylen
- / BITS_PER_BYTE;
- dbg("compute_proto_keymat: key_len=%d from peer",
- (int)needed_len);
- }
- break;
- }
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
+ {
+ enum_buf eb;
+ llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
+ str_enum(&esp_transformid_names, protoid, &eb));
+ return false;
+ }
}
dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
DBG_dump_hunk(" inbound:", pi->inbound.keymat);
DBG_dump_hunk(" outbound:", pi->outbound.keymat);
}
+
+ return true;
}
-static void compute_keymats(struct state *st)
+static bool compute_keymats(struct state *st)
{
if (st->st_ah.present)
- compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
+ return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
if (st->st_esp.present)
- compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
+ return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
+ return false;
}
/*
@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
/* Derive new keying material */
- compute_keymats(st);
+ if (!compute_keymats(st)) {
+ return STF_FATAL;
+ }
/* Tell the kernel to establish the new inbound SA
* (unless the commit bit is set -- which we don't support).
--
2.45.0

6
libreswan.spec
View File

@ -31,7 +31,7 @@ Name: libreswan
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
# version is generated in the release script
Version: 4.12
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}
Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
License: GPLv2
Url: https://libreswan.org/
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
@ -43,6 +43,7 @@ Source3: https://download.libreswan.org/cavs/ikev2.fax.bz2
Patch: libreswan-4.6-ikev1-policy-defaults-to-drop.patch
Patch: libreswan-4.12-ikev2-auth-delete-state.patch
Patch: libreswan-4.12-ipv6-san.patch
Patch: libreswan-4.12-ikev1-compute-keymat-default.patch
BuildRequires: audit-libs-devel
BuildRequires: bison
@ -198,6 +199,9 @@ certutil -N -d sql:$tmpdir --empty-password
%doc %{_mandir}/*/*
%changelog
* Wed Jun 5 2024 Daiki Ueno <dueno@redhat.com> - 4.12-3
- Fix CVE-2024-3652 (RHEL-32483)
* Thu Apr 11 2024 Daiki Ueno <dueno@redhat.com> - 4.12-2
- Fix CVE-2024-2357 (RHEL-28743)
- x509: unpack IPv6 general names based on length (RHEL-32720)