yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-26 03:15:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream-restricted/pr/425' into development-restricted

Browse Source
This commit is contained in:
Gilles Peskine 2017-12-01 17:58:12 +01:00
commit 02e28fe0fd
3 changed files with 33 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -32,6 +32,12 @@ Security
Reported by Marco Macchetti, Kudelski Group. Reported by Marco Macchetti, Kudelski Group.
* Wipe stack buffer temporarily holding EC private exponent * Wipe stack buffer temporarily holding EC private exponent
after keypair generation. after keypair generation.
* Fix heap corruption in implementation of truncated HMAC extension.
When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet can be used to selectively
corrupt 6 bytes on the peer's heap, potentially leading to crash or
remote code execution. This can be triggered remotely from either
side in both TLS and DTLS.
Features Features
* Allow comments in test data files. * Allow comments in test data files.

36
library/ssl_tls.c
View File

@ -1293,14 +1293,17 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
defined(MBEDTLS_SSL_PROTO_TLS1_2) defined(MBEDTLS_SSL_PROTO_TLS1_2)
if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 ) if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
{ {
unsigned char mac[MBEDTLS_SSL_MAC_ADD];
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 ); mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 );
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 ); mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 );
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 ); mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 );
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
ssl->out_msg, ssl->out_msglen ); ssl->out_msg, ssl->out_msglen );
mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mac );
ssl->out_msg + ssl->out_msglen );
mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc ); mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
memcpy( ssl->out_msg + ssl->out_msglen, mac, ssl->transform_out->maclen );
} }
else else
#endif #endif
@ -1562,8 +1565,6 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
return( 0 ); return( 0 );
} }
#define SSL_MAX_MAC_SIZE 48
static int ssl_decrypt_buf( mbedtls_ssl_context *ssl ) static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
{ {
size_t i; size_t i;
@ -1731,7 +1732,7 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED ) if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
{ {
unsigned char computed_mac[SSL_MAX_MAC_SIZE]; unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
unsigned char pseudo_hdr[13]; unsigned char pseudo_hdr[13];
MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) ); MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
@ -1749,16 +1750,16 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 ); mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 );
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec,
ssl->in_iv, ssl->in_msglen ); ssl->in_iv, ssl->in_msglen );
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, computed_mac ); mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec ); mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen, MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen,
ssl->transform_in->maclen ); ssl->transform_in->maclen );
MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", computed_mac, MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
ssl->transform_in->maclen ); ssl->transform_in->maclen );
if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, computed_mac, if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, mac_expect,
ssl->transform_in->maclen ) != 0 ) ssl->transform_in->maclen ) != 0 )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) ); MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
@ -1918,15 +1919,13 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
#if defined(SSL_SOME_MODES_USE_MAC) #if defined(SSL_SOME_MODES_USE_MAC)
if( auth_done == 0 ) if( auth_done == 0 )
{ {
unsigned char tmp[SSL_MAX_MAC_SIZE]; unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
ssl->in_msglen -= ssl->transform_in->maclen; ssl->in_msglen -= ssl->transform_in->maclen;
ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 ); ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
ssl->in_len[1] = (unsigned char)( ssl->in_msglen ); ssl->in_len[1] = (unsigned char)( ssl->in_msglen );
memcpy( tmp, ssl->in_msg + ssl->in_msglen, ssl->transform_in->maclen );
#if defined(MBEDTLS_SSL_PROTO_SSL3) #if defined(MBEDTLS_SSL_PROTO_SSL3)
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
{ {
@ -1965,8 +1964,7 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 ); mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 );
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg, mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg,
ssl->in_msglen ); ssl->in_msglen );
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
ssl->in_msg + ssl->in_msglen );
/* Call mbedtls_md_process at least once due to cache attacks */ /* Call mbedtls_md_process at least once due to cache attacks */
for( j = 0; j < extra_run + 1; j++ ) for( j = 0; j < extra_run + 1; j++ )
mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg ); mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
@ -1981,12 +1979,12 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
} }
MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", tmp, ssl->transform_in->maclen ); MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, ssl->transform_in->maclen );
MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen, MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_msg + ssl->in_msglen,
ssl->transform_in->maclen ); ssl->transform_in->maclen );
if( mbedtls_ssl_safer_memcmp( tmp, ssl->in_msg + ssl->in_msglen, if( mbedtls_ssl_safer_memcmp( ssl->in_msg + ssl->in_msglen, mac_expect,
ssl->transform_in->maclen ) != 0 ) ssl->transform_in->maclen ) != 0 )
{ {
#if defined(MBEDTLS_SSL_DEBUG_ALL) #if defined(MBEDTLS_SSL_DEBUG_ALL)
MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) ); MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );

20
tests/ssl-opt.sh
View File

@ -829,40 +829,40 @@ run_test "Truncated HMAC: client default, server default" \
"$P_SRV debug_level=4" \ "$P_SRV debug_level=4" \
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
0 \ 0 \
-s "dumping 'computed mac' (20 bytes)" \ -s "dumping 'expected mac' (20 bytes)" \
-S "dumping 'computed mac' (10 bytes)" -S "dumping 'expected mac' (10 bytes)"
run_test "Truncated HMAC: client disabled, server default" \ run_test "Truncated HMAC: client disabled, server default" \
"$P_SRV debug_level=4" \ "$P_SRV debug_level=4" \
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
trunc_hmac=0" \ trunc_hmac=0" \
0 \ 0 \
-s "dumping 'computed mac' (20 bytes)" \ -s "dumping 'expected mac' (20 bytes)" \
-S "dumping 'computed mac' (10 bytes)" -S "dumping 'expected mac' (10 bytes)"
run_test "Truncated HMAC: client enabled, server default" \ run_test "Truncated HMAC: client enabled, server default" \
"$P_SRV debug_level=4" \ "$P_SRV debug_level=4" \
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
trunc_hmac=1" \ trunc_hmac=1" \
0 \ 0 \
-s "dumping 'computed mac' (20 bytes)" \ -s "dumping 'expected mac' (20 bytes)" \
-S "dumping 'computed mac' (10 bytes)" -S "dumping 'expected mac' (10 bytes)"
run_test "Truncated HMAC: client enabled, server disabled" \ run_test "Truncated HMAC: client enabled, server disabled" \
"$P_SRV debug_level=4 trunc_hmac=0" \ "$P_SRV debug_level=4 trunc_hmac=0" \
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
trunc_hmac=1" \ trunc_hmac=1" \
0 \ 0 \
-s "dumping 'computed mac' (20 bytes)" \ -s "dumping 'expected mac' (20 bytes)" \
-S "dumping 'computed mac' (10 bytes)" -S "dumping 'expected mac' (10 bytes)"
run_test "Truncated HMAC: client enabled, server enabled" \ run_test "Truncated HMAC: client enabled, server enabled" \
"$P_SRV debug_level=4 trunc_hmac=1" \ "$P_SRV debug_level=4 trunc_hmac=1" \
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
trunc_hmac=1" \ trunc_hmac=1" \
0 \ 0 \
-S "dumping 'computed mac' (20 bytes)" \ -S "dumping 'expected mac' (20 bytes)" \
-s "dumping 'computed mac' (10 bytes)" -s "dumping 'expected mac' (10 bytes)"
# Tests for Encrypt-then-MAC extension # Tests for Encrypt-then-MAC extension