mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-11-26 20:05:38 +01:00
Merge remote-tracking branch 'upstream-restricted/pr/427' into mbedtls-2.1-restricted
This commit is contained in:
Gilles Peskine
commit
aed7188b2e
@ -32,6 +32,12 @@ Security
|
||||
Reported by Marco Macchetti, Kudelski Group.
|
||||
* Wipe stack buffer temporarily holding EC private exponent
|
||||
after keypair generation.
|
||||
* Fix heap corruption in implementation of truncated HMAC extension.
|
||||
When the truncated HMAC extension is enabled and CBC is used,
|
||||
sending a malicious application packet can be used to selectively
|
||||
corrupt 6 bytes on the peer's heap, potentially leading to crash or
|
||||
remote code execution. This can be triggered remotely from either
|
||||
side in both TLS and DTLS.
|
||||
|
||||
Bugfix
|
||||
* Fix some invalid RSA-PSS signatures with keys of size 8N+1 that were
|
||||
|
||||
@ -1284,14 +1284,17 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
|
||||
{
|
||||
unsigned char mac[MBEDTLS_SSL_MAC_ADD];
|
||||
|
||||
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 );
|
||||
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 );
|
||||
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 );
|
||||
mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
|
||||
ssl->out_msg, ssl->out_msglen );
|
||||
mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc,
|
||||
ssl->out_msg + ssl->out_msglen );
|
||||
mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mac );
|
||||
mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
|
||||
|
||||
memcpy( ssl->out_msg + ssl->out_msglen, mac, ssl->transform_out->maclen );
|
||||
}
|
||||
else
|
||||
#endif
|
||||
@ -1553,8 +1556,6 @@ static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
#define SSL_MAX_MAC_SIZE 48
|
||||
|
||||
static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
|
||||
{
|
||||
size_t i;
|
||||
@ -1722,7 +1723,7 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
|
||||
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
|
||||
{
|
||||
unsigned char computed_mac[SSL_MAX_MAC_SIZE];
|
||||
unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
|
||||
unsigned char pseudo_hdr[13];
|
||||
|
||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
|
||||
@ -1740,16 +1741,16 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
|
||||
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 );
|
||||
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec,
|
||||
ssl->in_iv, ssl->in_msglen );
|
||||
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, computed_mac );
|
||||
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
|
||||
mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
|
||||
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen,
|
||||
ssl->transform_in->maclen );
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", computed_mac,
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
|
||||
ssl->transform_in->maclen );
|
||||
|
||||
if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, computed_mac,
|
||||
ssl->transform_in->maclen ) != 0 )
|
||||
if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, mac_expect,
|
||||
ssl->transform_in->maclen ) != 0 )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
|
||||
|
||||
@ -1909,15 +1910,13 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
|
||||
#if defined(SSL_SOME_MODES_USE_MAC)
|
||||
if( auth_done == 0 )
|
||||
{
|
||||
unsigned char tmp[SSL_MAX_MAC_SIZE];
|
||||
unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
|
||||
|
||||
ssl->in_msglen -= ssl->transform_in->maclen;
|
||||
|
||||
ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
|
||||
ssl->in_len[1] = (unsigned char)( ssl->in_msglen );
|
||||
|
||||
memcpy( tmp, ssl->in_msg + ssl->in_msglen, ssl->transform_in->maclen );
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
|
||||
{
|
||||
@ -1956,8 +1955,7 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
|
||||
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 );
|
||||
mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg,
|
||||
ssl->in_msglen );
|
||||
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec,
|
||||
ssl->in_msg + ssl->in_msglen );
|
||||
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
|
||||
/* Call mbedtls_md_process at least once due to cache attacks */
|
||||
for( j = 0; j < extra_run + 1; j++ )
|
||||
mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
|
||||
@ -1972,12 +1970,12 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
|
||||
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
|
||||
}
|
||||
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", tmp, ssl->transform_in->maclen );
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen,
|
||||
ssl->transform_in->maclen );
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, ssl->transform_in->maclen );
|
||||
MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_msg + ssl->in_msglen,
|
||||
ssl->transform_in->maclen );
|
||||
|
||||
if( mbedtls_ssl_safer_memcmp( tmp, ssl->in_msg + ssl->in_msglen,
|
||||
ssl->transform_in->maclen ) != 0 )
|
||||
if( mbedtls_ssl_safer_memcmp( ssl->in_msg + ssl->in_msglen, mac_expect,
|
||||
ssl->transform_in->maclen ) != 0 )
|
||||
{
|
||||
#if defined(MBEDTLS_SSL_DEBUG_ALL)
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
|
||||
|
||||
@ -699,40 +699,40 @@ run_test "Truncated HMAC: client default, server default" \
|
||||
"$P_SRV debug_level=4" \
|
||||
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
|
||||
0 \
|
||||
-s "dumping 'computed mac' (20 bytes)" \
|
||||
-S "dumping 'computed mac' (10 bytes)"
|
||||
-s "dumping 'expected mac' (20 bytes)" \
|
||||
-S "dumping 'expected mac' (10 bytes)"
|
||||
|
||||
run_test "Truncated HMAC: client disabled, server default" \
|
||||
"$P_SRV debug_level=4" \
|
||||
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
|
||||
trunc_hmac=0" \
|
||||
0 \
|
||||
-s "dumping 'computed mac' (20 bytes)" \
|
||||
-S "dumping 'computed mac' (10 bytes)"
|
||||
-s "dumping 'expected mac' (20 bytes)" \
|
||||
-S "dumping 'expected mac' (10 bytes)"
|
||||
|
||||
run_test "Truncated HMAC: client enabled, server default" \
|
||||
"$P_SRV debug_level=4" \
|
||||
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
|
||||
trunc_hmac=1" \
|
||||
0 \
|
||||
-s "dumping 'computed mac' (20 bytes)" \
|
||||
-S "dumping 'computed mac' (10 bytes)"
|
||||
-s "dumping 'expected mac' (20 bytes)" \
|
||||
-S "dumping 'expected mac' (10 bytes)"
|
||||
|
||||
run_test "Truncated HMAC: client enabled, server disabled" \
|
||||
"$P_SRV debug_level=4 trunc_hmac=0" \
|
||||
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
|
||||
trunc_hmac=1" \
|
||||
0 \
|
||||
-s "dumping 'computed mac' (20 bytes)" \
|
||||
-S "dumping 'computed mac' (10 bytes)"
|
||||
-s "dumping 'expected mac' (20 bytes)" \
|
||||
-S "dumping 'expected mac' (10 bytes)"
|
||||
|
||||
run_test "Truncated HMAC: client enabled, server enabled" \
|
||||
"$P_SRV debug_level=4 trunc_hmac=1" \
|
||||
"$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
|
||||
trunc_hmac=1" \
|
||||
0 \
|
||||
-S "dumping 'computed mac' (20 bytes)" \
|
||||
-s "dumping 'computed mac' (10 bytes)"
|
||||
-S "dumping 'expected mac' (20 bytes)" \
|
||||
-s "dumping 'expected mac' (10 bytes)"
|
||||
|
||||
# Tests for Encrypt-then-MAC extension
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user