From dba9cab3de6e899f2f3648e0c7426bdf5a78d091 Mon Sep 17 00:00:00 2001 From: Clemens Lang Date: Thu, 19 Oct 2023 15:13:13 +0200 Subject: [PATCH] Fix CVE-2023-3446, CVE-2023-3817 - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value Resolves: RHEL-14245 Resolves: RHEL-14239 Signed-off-by: Clemens Lang --- openssl-1.1.1-cve-2023-3446.patch | 127 ++++++++++++++++++++++++++++++ openssl-1.1.1-cve-2023-3817.patch | 60 ++++++++++++++ openssl.spec | 13 ++- 3 files changed, 199 insertions(+), 1 deletion(-) create mode 100644 openssl-1.1.1-cve-2023-3446.patch create mode 100644 openssl-1.1.1-cve-2023-3817.patch diff --git a/openssl-1.1.1-cve-2023-3446.patch b/openssl-1.1.1-cve-2023-3446.patch new file mode 100644 index 0000000..43695b0 --- /dev/null +++ b/openssl-1.1.1-cve-2023-3446.patch @@ -0,0 +1,127 @@ +From 8780a896543a654e757db1b9396383f9d8095528 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Thu, 6 Jul 2023 16:36:35 +0100 +Subject: [PATCH] Fix DH_check() excessive time with over sized modulus + +The DH_check() function checks numerous aspects of the key or parameters +that have been supplied. Some of those checks use the supplied modulus +value even if it is excessively large. + +There is already a maximum DH modulus size (10,000 bits) over which +OpenSSL will not generate or derive keys. DH_check() will however still +perform various tests for validity on such a large modulus. We introduce a +new maximum (32,768) over which DH_check() will just fail. + +An application that calls DH_check() and supplies a key or parameters +obtained from an untrusted source could be vulnerable to a Denial of +Service attack. + +The function DH_check() is itself called by a number of other OpenSSL +functions. An application calling any of those other functions may +similarly be affected. The other functions affected by this are +DH_check_ex() and EVP_PKEY_param_check(). + +CVE-2023-3446 + +Reviewed-by: Paul Dale +Reviewed-by: Tom Cosgrove +Reviewed-by: Bernd Edlinger +Reviewed-by: Tomas Mraz +(Merged from https://github.com/openssl/openssl/pull/21452) + +Upstream-Status: Backport [8780a896543a654e757db1b9396383f9d8095528] +--- + crypto/dh/dh_check.c | 6 ++++++ + crypto/dh/dh_err.c | 3 ++- + crypto/err/openssl.txt | 3 ++- + include/openssl/dh.h | 3 +++ + include/openssl/dherr.h | 3 ++- + 5 files changed, 15 insertions(+), 3 deletions(-) + +diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c +index 4ac169e75c..e5f9dd5030 100644 +--- a/crypto/dh/dh_check.c ++++ b/crypto/dh/dh_check.c +@@ -101,6 +101,12 @@ int DH_check(const DH *dh, int *ret) + BN_CTX *ctx = NULL; + BIGNUM *t1 = NULL, *t2 = NULL; + ++ /* Don't do any checks at all with an excessively large modulus */ ++ if (BN_num_bits(dh->p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) { ++ DHerr(DH_F_DH_CHECK, DH_R_MODULUS_TOO_LARGE); ++ return 0; ++ } ++ + if (!DH_check_params(dh, ret)) + return 0; + +diff --git a/crypto/dh/dh_err.c b/crypto/dh/dh_err.c +index 7285587b4a..92800d3fcc 100644 +--- a/crypto/dh/dh_err.c ++++ b/crypto/dh/dh_err.c +@@ -1,6 +1,6 @@ + /* + * Generated by util/mkerr.pl DO NOT EDIT +- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. ++ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy +@@ -18,6 +18,7 @@ static const ERR_STRING_DATA DH_str_functs[] = { + {ERR_PACK(ERR_LIB_DH, DH_F_DHPARAMS_PRINT_FP, 0), "DHparams_print_fp"}, + {ERR_PACK(ERR_LIB_DH, DH_F_DH_BUILTIN_GENPARAMS, 0), + "dh_builtin_genparams"}, ++ {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK, 0), "DH_check"}, + {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_EX, 0), "DH_check_ex"}, + {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PARAMS_EX, 0), "DH_check_params_ex"}, + {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PUB_KEY_EX, 0), "DH_check_pub_key_ex"}, +diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt +index 9f91a4a811..c0a3cd720b 100644 +--- a/crypto/err/openssl.txt ++++ b/crypto/err/openssl.txt +@@ -402,6 +402,7 @@ CT_F_SCT_SET_VERSION:104:SCT_set_version + DH_F_COMPUTE_KEY:102:compute_key + DH_F_DHPARAMS_PRINT_FP:101:DHparams_print_fp + DH_F_DH_BUILTIN_GENPARAMS:106:dh_builtin_genparams ++DH_F_DH_CHECK:126:DH_check + DH_F_DH_CHECK_EX:121:DH_check_ex + DH_F_DH_CHECK_PARAMS_EX:122:DH_check_params_ex + DH_F_DH_CHECK_PUB_KEY_EX:123:DH_check_pub_key_ex +diff --git a/include/openssl/dh.h b/include/openssl/dh.h +index 3527540cdd..892e31559d 100644 +--- a/include/openssl/dh.h ++++ b/include/openssl/dh.h +@@ -29,6 +29,9 @@ extern "C" { + # ifndef OPENSSL_DH_MAX_MODULUS_BITS + # define OPENSSL_DH_MAX_MODULUS_BITS 10000 + # endif ++# ifndef OPENSSL_DH_CHECK_MAX_MODULUS_BITS ++# define OPENSSL_DH_CHECK_MAX_MODULUS_BITS 32768 ++# endif + + # define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024 + # define OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN 2048 + +diff --git a/include/openssl/dherr.h b/include/openssl/dherr.h +index 916b3bed0b..528c819856 100644 +--- a/include/openssl/dherr.h ++++ b/include/openssl/dherr.h +@@ -1,6 +1,6 @@ + /* + * Generated by util/mkerr.pl DO NOT EDIT +- * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. ++ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy +@@ -30,6 +30,7 @@ int ERR_load_DH_strings(void); + # define DH_F_COMPUTE_KEY 102 + # define DH_F_DHPARAMS_PRINT_FP 101 + # define DH_F_DH_BUILTIN_GENPARAMS 106 ++# define DH_F_DH_CHECK 126 + # define DH_F_DH_CHECK_EX 121 + # define DH_F_DH_CHECK_PARAMS_EX 122 + # define DH_F_DH_CHECK_PUB_KEY_EX 123 +-- +2.41.0 + diff --git a/openssl-1.1.1-cve-2023-3817.patch b/openssl-1.1.1-cve-2023-3817.patch new file mode 100644 index 0000000..453e2b3 --- /dev/null +++ b/openssl-1.1.1-cve-2023-3817.patch @@ -0,0 +1,60 @@ +From 91ddeba0f2269b017dc06c46c993a788974b1aa5 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Fri, 21 Jul 2023 11:39:41 +0200 +Subject: [PATCH] DH_check(): Do not try checking q properties if it is + obviously invalid + +If |q| >= |p| then the q value is obviously wrong as q +is supposed to be a prime divisor of p-1. + +We check if p is overly large so this added test implies that +q is not large either when performing subsequent tests using that +q value. + +Otherwise if it is too large these additional checks of the q value +such as the primality test can then trigger DoS by doing overly long +computations. + +Fixes CVE-2023-3817 + +Reviewed-by: Paul Dale +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/21551) + +Upstream-Status: Backport [91ddeba0f2269b017dc06c46c993a788974b1aa5] +--- + crypto/dh/dh_check.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c +index 2001d2e7cb..9ae96991eb 100644 +--- a/crypto/dh/dh_check.c ++++ b/crypto/dh/dh_check.c +@@ -105,7 +105,7 @@ int DH_check_ex(const DH *dh) + /* Note: according to documentation - this only checks the params */ + int DH_check(const DH *dh, int *ret) + { +- int ok = 0, r; ++ int ok = 0, r, q_good = 0; + BN_CTX *ctx = NULL; + BIGNUM *t1 = NULL, *t2 = NULL; + +@@ -130,7 +130,14 @@ int DH_check(const DH *dh, int *ret) + if (t2 == NULL) + goto err; + +- if (dh->q) { ++ if (dh->q != NULL) { ++ if (BN_ucmp(dh->p, dh->q) > 0) ++ q_good = 1; ++ else ++ *ret |= DH_CHECK_INVALID_Q_VALUE; ++ } ++ ++ if (q_good) { + if (BN_cmp(dh->g, BN_value_one()) <= 0) + *ret |= DH_NOT_SUITABLE_GENERATOR; + else if (BN_cmp(dh->g, dh->p) >= 0) +-- +2.41.0 + diff --git a/openssl.spec b/openssl.spec index 5601480..8df7b4e 100644 --- a/openssl.spec +++ b/openssl.spec @@ -22,7 +22,7 @@ Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 1.1.1k -Release: 9%{?dist} +Release: 10%{?dist} Epoch: 1 # We have to remove certain patented algorithms from the openssl source # tarball with the hobble-openssl script which is included below. @@ -92,6 +92,9 @@ Patch101: openssl-1.1.1-cve-2022-4304-RSA-oracle.patch Patch102: openssl-1.1.1-cve-2022-4450-PEM-bio.patch Patch103: openssl-1.1.1-cve-2023-0215-BIO-UAF.patch Patch104: openssl-1.1.1-cve-2023-0286-X400.patch +# OpenSSL 1.1.1v CVEs +Patch105: openssl-1.1.1-cve-2023-3446.patch +Patch106: openssl-1.1.1-cve-2023-3817.patch License: OpenSSL and ASL 2.0 URL: http://www.openssl.org/ @@ -221,6 +224,8 @@ cp %{SOURCE13} test/ %patch102 -p1 -b .cve-2022-4450 %patch103 -p1 -b .cve-2023-0215 %patch104 -p1 -b .cve-2023-0286 +%patch105 -p1 -b .cve-2023-3446 +%patch106 -p1 -b .cve-2023-3817 %build # Figure out which flags we want to use. @@ -504,6 +509,12 @@ export LD_LIBRARY_PATH %postun libs -p /sbin/ldconfig %changelog +* Thu Oct 19 2023 Clemens Lang - 1:1.1.1k-10 +- Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters + Resolves: RHEL-14245 +- Fix CVE-2023-3817: Excessive time spent checking DH q parameter value + Resolves: RHEL-14239 + * Wed Feb 08 2023 Dmitry Belyavskiy - 1:1.1.1k-9 - Fixed Timing Oracle in RSA Decryption Resolves: CVE-2022-4304