diff --git a/nettle-3.8-zeroize-stack.patch b/nettle-3.8-zeroize-stack.patch new file mode 100644 index 0000000..0f96571 --- /dev/null +++ b/nettle-3.8-zeroize-stack.patch @@ -0,0 +1,334 @@ +From 894b22e6d851512776bd62e85e749d6950ce16fc Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Wed, 24 Aug 2022 17:19:57 +0900 +Subject: [PATCH] Clear any intermediate data allocate on stack + +Signed-off-by: Daiki Ueno +--- + cbc.c | 3 +++ + cfb.c | 13 +++++++++++++ + ctr.c | 4 ++++ + ctr16.c | 2 ++ + ecc-random.c | 3 +++ + ecdsa-keygen.c | 2 ++ + ecdsa-sign.c | 2 ++ + ed25519-sha512-sign.c | 2 ++ + ed448-shake256-sign.c | 2 ++ + gostdsa-sign.c | 2 ++ + hmac.c | 10 +++++++--- + nettle-internal.h | 5 +++++ + pbkdf2.c | 5 ++++- + pss-mgf1.c | 5 ++++- + pss.c | 4 ++++ + 15 files changed, 59 insertions(+), 5 deletions(-) + +diff --git a/cbc.c b/cbc.c +index 76b6492d..b9da3aa0 100644 +--- a/cbc.c ++++ b/cbc.c +@@ -128,6 +128,9 @@ cbc_decrypt(const void *ctx, nettle_cipher_func *f, + length - block_size); + /* Writes first block. */ + memxor3(dst, buffer, initial_iv, block_size); ++ ++ TMP_CLEAR(buffer, buffer_size); ++ TMP_CLEAR(initial_iv, block_size); + } + } + +diff --git a/cfb.c b/cfb.c +index b9da3159..b1b01b9e 100644 +--- a/cfb.c ++++ b/cfb.c +@@ -83,6 +83,8 @@ cfb_encrypt(const void *ctx, nettle_cipher_func *f, + /* We do not care about updating IV here. This is the last call in + * message sequence and one has to set IV afterwards anyway */ + } ++ ++ TMP_CLEAR(buffer, block_size); + } + + /* Don't allocate any more space than this on the stack */ +@@ -115,6 +117,8 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f, + + f(ctx, block_size, buffer, iv); + memxor3(dst + length, src + length, buffer, left); ++ ++ TMP_CLEAR(buffer, block_size); + } + } + else +@@ -160,6 +164,9 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f, + f(ctx, block_size, buffer, iv); + memxor(dst, buffer, left); + } ++ ++ TMP_CLEAR(buffer, buffer_size); ++ TMP_CLEAR(initial_iv, block_size); + } + } + +@@ -196,6 +203,9 @@ cfb8_encrypt(const void *ctx, nettle_cipher_func *f, + pos ++; + } + memcpy(iv, buffer + pos, block_size); ++ ++ TMP_CLEAR(buffer, block_size * 2); ++ TMP_CLEAR(outbuf, block_size); + } + + void +@@ -235,4 +245,7 @@ cfb8_decrypt(const void *ctx, nettle_cipher_func *f, + } + + memcpy(iv, buffer + i, block_size); ++ ++ TMP_CLEAR(buffer, block_size * 2); ++ TMP_CLEAR(outbuf, block_size * 2); + } +diff --git a/ctr.c b/ctr.c +index 8c6b4626..217d1abb 100644 +--- a/ctr.c ++++ b/ctr.c +@@ -137,6 +137,8 @@ ctr_crypt(const void *ctx, nettle_cipher_func *f, + f(ctx, block_size, block, ctr); + INCREMENT(block_size, ctr); + memxor3(dst + filled, src + filled, block, length - filled); ++ ++ TMP_CLEAR(block, block_size); + } + } + else +@@ -173,5 +175,7 @@ ctr_crypt(const void *ctx, nettle_cipher_func *f, + INCREMENT(block_size, ctr); + memxor(dst, buffer, length); + } ++ ++ TMP_CLEAR(buffer, buffer_size); + } + } +diff --git a/ctr16.c b/ctr16.c +index d744d2a9..ec0abd72 100644 +--- a/ctr16.c ++++ b/ctr16.c +@@ -102,5 +102,7 @@ _nettle_ctr_crypt16(const void *ctx, nettle_cipher_func *f, + done: + memxor3 (dst + i, src + i, buffer->b, length - i); + } ++ ++ TMP_CLEAR(buffer, MIN(blocks, CTR_BUFFER_LIMIT / 16)); + } + } +diff --git a/ecc-random.c b/ecc-random.c +index a7b48d6a..676f5933 100644 +--- a/ecc-random.c ++++ b/ecc-random.c +@@ -36,6 +36,7 @@ + #endif + + #include ++#include + + #include "ecc.h" + #include "ecc-internal.h" +@@ -79,4 +80,6 @@ ecc_scalar_random (struct ecc_scalar *x, + TMP_ALLOC (scratch, ECC_MOD_RANDOM_ITCH (x->ecc->q.size)); + + ecc_mod_random (&x->ecc->q, x->p, random_ctx, random, scratch); ++ ++ TMP_CLEAR (scratch, ECC_MOD_RANDOM_ITCH (x->ecc->q.size)); + } +diff --git a/ecdsa-keygen.c b/ecdsa-keygen.c +index 870282b0..05dd827a 100644 +--- a/ecdsa-keygen.c ++++ b/ecdsa-keygen.c +@@ -59,4 +59,6 @@ ecdsa_generate_keypair (struct ecc_point *pub, + ecc_mod_random (&ecc->q, key->p, random_ctx, random, p); + ecc->mul_g (ecc, p, key->p, p + 3*ecc->p.size); + ecc->h_to_a (ecc, 0, pub->p, p, p + 3*ecc->p.size); ++ ++ TMP_CLEAR (p, itch); + } +diff --git a/ecdsa-sign.c b/ecdsa-sign.c +index e6fb3287..e6b960bf 100644 +--- a/ecdsa-sign.c ++++ b/ecdsa-sign.c +@@ -68,4 +68,6 @@ ecdsa_sign (const struct ecc_scalar *key, + mpz_limbs_finish (signature->s, size); + } + while (mpz_sgn (signature->r) == 0 || mpz_sgn (signature->s) == 0); ++ ++ TMP_CLEAR (k, size + ECC_ECDSA_SIGN_ITCH (size)); + } +diff --git a/ed25519-sha512-sign.c b/ed25519-sha512-sign.c +index 389a157e..52a46ea5 100644 +--- a/ed25519-sha512-sign.c ++++ b/ed25519-sha512-sign.c +@@ -38,6 +38,7 @@ + + #include "ecc-internal.h" + #include "sha2.h" ++#include + + void + ed25519_sha512_sign (const uint8_t *pub, +@@ -61,6 +62,7 @@ ed25519_sha512_sign (const uint8_t *pub, + length, msg, signature, scratch_out); + + gmp_free_limbs (scratch, itch); ++ explicit_bzero (digest, sizeof(digest)); + #undef k1 + #undef k2 + #undef scratch_out +diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c +index c524593d..01abf457 100644 +--- a/ed448-shake256-sign.c ++++ b/ed448-shake256-sign.c +@@ -39,6 +39,7 @@ + #include "ecc-internal.h" + #include "eddsa-internal.h" + #include "sha3.h" ++#include + + void + ed448_shake256_sign (const uint8_t *pub, +@@ -63,6 +64,7 @@ ed448_shake256_sign (const uint8_t *pub, + length, msg, signature, scratch_out); + + gmp_free_limbs (scratch, itch); ++ explicit_bzero (digest, sizeof(digest)); + #undef k1 + #undef k2 + #undef scratch_out +diff --git a/gostdsa-sign.c b/gostdsa-sign.c +index 892c0742..a7e0c21d 100644 +--- a/gostdsa-sign.c ++++ b/gostdsa-sign.c +@@ -71,4 +71,6 @@ gostdsa_sign (const struct ecc_scalar *key, + mpz_limbs_finish (signature->s, size); + } + while (mpz_sgn (signature->r) == 0 || mpz_sgn (signature->s) == 0); ++ ++ TMP_CLEAR (k, size + ECC_GOSTDSA_SIGN_ITCH (size)); + } +diff --git a/hmac.c b/hmac.c +index 6ac5e11a..0ac33bed 100644 +--- a/hmac.c ++++ b/hmac.c +@@ -55,6 +55,8 @@ hmac_set_key(void *outer, void *inner, void *state, + { + TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE); + TMP_ALLOC(pad, hash->block_size); ++ TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); ++ TMP_ALLOC(digest, hash->digest_size); + + hash->init(outer); + hash->init(inner); +@@ -64,9 +66,6 @@ hmac_set_key(void *outer, void *inner, void *state, + /* Reduce key to the algorithm's hash size. Use the area pointed + * to by state for the temporary state. */ + +- TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); +- TMP_ALLOC(digest, hash->digest_size); +- + hash->init(state); + hash->update(state, key_length, key); + hash->digest(state, hash->digest_size, digest); +@@ -88,6 +87,9 @@ hmac_set_key(void *outer, void *inner, void *state, + hash->update(inner, hash->block_size, pad); + + memcpy(state, inner, hash->context_size); ++ ++ TMP_CLEAR(pad, hash->block_size); ++ TMP_CLEAR(digest, hash->digest_size); + } + + void +@@ -114,4 +116,6 @@ hmac_digest(const void *outer, const void *inner, void *state, + hash->digest(state, length, dst); + + memcpy(state, inner, hash->context_size); ++ ++ TMP_CLEAR(digest, hash->digest_size); + } +diff --git a/nettle-internal.h b/nettle-internal.h +index ddc483de..9fc55514 100644 +--- a/nettle-internal.h ++++ b/nettle-internal.h +@@ -72,6 +72,11 @@ + do { assert((size_t)(size) <= (sizeof(name))); } while (0) + #endif + ++#include /* explicit_bzero */ ++ ++#define TMP_CLEAR(name, size) (explicit_bzero (name, sizeof (*name) * (size))) ++#define TMP_CLEAR_ALIGN(name, size) (explicit_bzero (name, size)) ++ + /* Arbitrary limits which apply to systems that don't have alloca */ + #define NETTLE_MAX_HASH_BLOCK_SIZE 128 + #define NETTLE_MAX_HASH_DIGEST_SIZE 64 +diff --git a/pbkdf2.c b/pbkdf2.c +index 291d138a..a8ecba5b 100644 +--- a/pbkdf2.c ++++ b/pbkdf2.c +@@ -92,8 +92,11 @@ pbkdf2 (void *mac_ctx, + if (length <= digest_size) + { + memcpy (dst, T, length); +- return; ++ break; + } + memcpy (dst, T, digest_size); + } ++ ++ TMP_CLEAR (U, digest_size); ++ TMP_CLEAR (T, digest_size); + } +diff --git a/pss-mgf1.c b/pss-mgf1.c +index 3f5e204b..3644c642 100644 +--- a/pss-mgf1.c ++++ b/pss-mgf1.c +@@ -66,8 +66,11 @@ pss_mgf1(const void *seed, const struct nettle_hash *hash, + if (length <= hash->digest_size) + { + hash->digest(state, length, mask); +- return; ++ break; + } + hash->digest(state, hash->digest_size, mask); + } ++ ++ TMP_CLEAR(h, hash->digest_size); ++ TMP_CLEAR_ALIGN(state, hash->context_size); + } +diff --git a/pss.c b/pss.c +index d28e7b13..8106ebf2 100644 +--- a/pss.c ++++ b/pss.c +@@ -77,6 +77,7 @@ pss_encode_mgf1(mpz_t m, size_t bits, + if (key_size < hash->digest_size + salt_length + 2) + { + TMP_GMP_FREE(em); ++ TMP_CLEAR_ALIGN(state, hash->context_size); + return 0; + } + +@@ -111,6 +112,7 @@ pss_encode_mgf1(mpz_t m, size_t bits, + + nettle_mpz_set_str_256_u(m, key_size, em); + TMP_GMP_FREE(em); ++ TMP_CLEAR_ALIGN(state, hash->context_size); + return 1; + } + +@@ -194,5 +196,7 @@ pss_verify_mgf1(const mpz_t m, size_t bits, + ret = 1; + cleanup: + TMP_GMP_FREE(em); ++ TMP_CLEAR(h2, hash->digest_size); ++ TMP_CLEAR_ALIGN(state, hash->context_size); + return ret; + } +-- +2.37.2 + diff --git a/nettle.spec b/nettle.spec index c504639..118b49c 100644 --- a/nettle.spec +++ b/nettle.spec @@ -26,7 +26,8 @@ Source0: %{name}-%{version}-hobbled.tar.xz Source1: %{name}-%{version_old}-hobbled.tar.xz Source2: nettle-3.5-remove-ecc-testsuite.patch %endif -Patch0: nettle-3.4-annocheck.patch +Patch: nettle-3.4-annocheck.patch +Patch: nettle-3.8-zeroize-stack.patch Source100: gmp-6.2.1.tar.xz # Taken from the main gmp package @@ -206,6 +207,7 @@ make check %changelog * Thu Aug 18 2022 Daiki Ueno - 3.8-2 - Bundle GMP to privatize memory functions +- Zeroize stack allocated intermediate data * Tue Jun 28 2022 Daiki Ueno - 3.8-1 - Update to nettle 3.8 (#1992457)