diff --git a/backport-CVE-2023-3817-DH_check-Do-not-try-checking-q-properties-if-it-is-o.patch b/backport-CVE-2023-3817-DH_check-Do-not-try-checking-q-properties-if-it-is-o.patch new file mode 100644 index 0000000000000000000000000000000000000000..244a0d8d2358ee04c47c122d5926572f820ae7ed --- /dev/null +++ b/backport-CVE-2023-3817-DH_check-Do-not-try-checking-q-properties-if-it-is-o.patch @@ -0,0 +1,59 @@ +From 91ddeba0f2269b017dc06c46c993a788974b1aa5 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Fri, 21 Jul 2023 11:39:41 +0200 +Subject: [PATCH] DH_check(): Do not try checking q properties if it is + obviously invalid + +If |q| >= |p| then the q value is obviously wrong as q +is supposed to be a prime divisor of p-1. + +We check if p is overly large so this added test implies that +q is not large either when performing subsequent tests using that +q value. + +Otherwise if it is too large these additional checks of the q value +such as the primality test can then trigger DoS by doing overly long +computations. + +Fixes CVE-2023-3817 + +Reviewed-by: Paul Dale +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/21551) + +--- + crypto/dh/dh_check.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c +index 2001d2e7cb..9ae96991eb 100644 +--- a/crypto/dh/dh_check.c ++++ b/crypto/dh/dh_check.c +@@ -97,7 +97,7 @@ int DH_check_ex(const DH *dh) + + int DH_check(const DH *dh, int *ret) + { +- int ok = 0, r; ++ int ok = 0, r, q_good = 0; + BN_CTX *ctx = NULL; + BIGNUM *t1 = NULL, *t2 = NULL; + +@@ -120,7 +120,14 @@ int DH_check(const DH *dh, int *ret) + if (t2 == NULL) + goto err; + +- if (dh->q) { ++ if (dh->q != NULL) { ++ if (BN_ucmp(dh->p, dh->q) > 0) ++ q_good = 1; ++ else ++ *ret |= DH_CHECK_INVALID_Q_VALUE; ++ } ++ ++ if (q_good) { + if (BN_cmp(dh->g, BN_value_one()) <= 0) + *ret |= DH_NOT_SUITABLE_GENERATOR; + else if (BN_cmp(dh->g, dh->p) >= 0) +-- +2.27.0 + diff --git a/backport-CVE-2023-3817-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch b/backport-CVE-2023-3817-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch new file mode 100644 index 0000000000000000000000000000000000000000..694b63a5d82a4b074ba2cb5b7b2bf901abc64a32 --- /dev/null +++ b/backport-CVE-2023-3817-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch @@ -0,0 +1,49 @@ +From 34d0f5cb93680a5286d1eb59125631ec8fd6dc81 Mon Sep 17 00:00:00 2001 +From: Tomas Mraz +Date: Tue, 25 Jul 2023 15:56:53 +0200 +Subject: [PATCH] dhtest.c: Add test of DH_check() with q = p + 1 + +This must fail with DH_CHECK_INVALID_Q_VALUE and +with DH_CHECK_Q_NOT_PRIME unset. + +Reviewed-by: Paul Dale +Reviewed-by: Matt Caswell +(Merged from https://github.com/openssl/openssl/pull/21551) + +--- + test/dhtest.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/test/dhtest.c b/test/dhtest.c +index 00b3c47101..d7e10ebda9 100644 +--- a/test/dhtest.c ++++ b/test/dhtest.c +@@ -123,6 +123,15 @@ static int dh_test(void) + /* check whether the public key was calculated correctly */ + TEST_uint_eq(BN_get_word(pub_key2), 3331L); + ++ if (!TEST_ptr(BN_copy(q, p)) || !TEST_true(BN_add(q, q, BN_value_one()))) ++ goto err3; ++ ++ if (!TEST_true(DH_check(dh, &i))) ++ goto err3; ++ if (!TEST_true(i & DH_CHECK_INVALID_Q_VALUE) ++ || !TEST_false(i & DH_CHECK_Q_NOT_PRIME)) ++ goto err3; ++ + /* Modulus of size: dh check max modulus bits + 1 */ + if (!TEST_true(BN_set_word(p, 1)) + || !TEST_true(BN_lshift(p, p, OPENSSL_DH_CHECK_MAX_MODULUS_BITS))) +@@ -134,6 +143,9 @@ static int dh_test(void) + if (!TEST_false(DH_check(dh, &i))) + goto err3; + ++ /* We'll have a stale error on the queue from the above test so clear it */ ++ ERR_clear_error(); ++ + /* + * II) key generation + */ +-- +2.27.0 + diff --git a/openssl.spec b/openssl.spec index 71256911a6af1df9145b8a8e7c9c3a3bab7c1b6e..ea8da38c2a2999d5374a918c87f402488be802b3 100644 --- a/openssl.spec +++ b/openssl.spec @@ -2,7 +2,7 @@ Name: openssl Epoch: 1 Version: 1.1.1m -Release: 21 +Release: 22 Summary: Cryptography and SSL/TLS Toolkit License: OpenSSL and SSLeay URL: https://www.openssl.org/ @@ -73,6 +73,8 @@ Patch62: backport-Generate-some-certificates-with-the-certificatePolic.patch Patch63: backport-CVE-2023-2650-Restrict-the-size-of-OBJECT-IDENTIFIERs-that-OBJ_obj.patch Patch64: backport-CVE-2023-3446-Fix-DH_check-excessive-time-with-over-sized-modulus.patch Patch65: backport-Add-a-test-for-CVE-2023-3446.patch +Patch66: backport-CVE-2023-3817-DH_check-Do-not-try-checking-q-properties-if-it-is-o.patch +Patch67: backport-CVE-2023-3817-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch BuildRequires: gcc perl make lksctp-tools-devel coreutils util-linux zlib-devel Requires: coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -281,6 +283,9 @@ make test || : %ldconfig_scriptlets libs %changelog +* Tue Aug 08 2023 steven - 1:1.1.1m-22 +- fix CVE-2023-3817 + * Sat Jul 22 2023 steven - 1:1.1.1m-21 - fix CVE-2023-3446