From 03e48223a0a8bf5c7882b36a12ecc7ef84374f82 Mon Sep 17 00:00:00 2001 From: Andy Fiddaman Date: Tue, 30 Jan 2024 16:28:07 +0000 Subject: [PATCH 1/3] openssl: update from 3.1.4 to 3.1.5 --- build/openssl/build-3.sh | 4 ++-- build/openssl/testsuite-3.log | 5 ++++- doc/packages.md | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/build/openssl/build-3.sh b/build/openssl/build-3.sh index 115a982479..3a58badff4 100755 --- a/build/openssl/build-3.sh +++ b/build/openssl/build-3.sh @@ -13,13 +13,13 @@ # }}} # # Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved. -# Copyright 2023 OmniOS Community Edition (OmniOSce) Association. +# Copyright 2024 OmniOS Community Edition (OmniOSce) Association. # . ../../lib/build.sh . common.sh PROG=openssl -VER=3.1.4 +VER=3.1.5 PKG=library/security/openssl-3 SUMMARY="Cryptography and SSL/TLS Toolkit" DESC="A toolkit for Secure Sockets Layer and Transport Layer protocols " diff --git a/build/openssl/testsuite-3.log b/build/openssl/testsuite-3.log index f974a4a863..652c93e211 100644 --- a/build/openssl/testsuite-3.log +++ b/build/openssl/testsuite-3.log @@ -42,6 +42,8 @@ Result: NOTESTS 03-test_ui.t ....................... ok 04-test_asn1_decode.t .............. ok 04-test_asn1_encode.t .............. ok +04-test_asn1_parse.t ............... ok +04-test_asn1_stable_parse.t ........ ok 04-test_asn1_string_table.t ........ ok 04-test_bio_callback.t ............. ok 04-test_bio_core.t ................. ok @@ -89,6 +91,7 @@ Result: NOTESTS 15-test_gendsa.t ................... ok 15-test_genec.t .................... ok 15-test_genrsa.t ................... ok +15-test_gensm2.t ................... ok 15-test_mp_rsa.t ................... ok 15-test_out_option.t ............... ok 15-test_rsa.t ...................... ok @@ -254,5 +257,5 @@ Result: NOTESTS 99-test_fuzz_server.t .............. ok 99-test_fuzz_x509.t ................ ok All tests successful. -Files=252, Tests=3347, +Files=255, Tests=3364, Result: PASS diff --git a/doc/packages.md b/doc/packages.md index 4d69ab642e..abd6f604bb 100644 --- a/doc/packages.md +++ b/doc/packages.md @@ -62,7 +62,7 @@ | library/readline7-patchlvl | 005 | https://ftp.gnu.org/gnu/readline/readline-7.0-patches/ | library/readline8-patchlvl | 002 | https://ftp.gnu.org/gnu/readline/readline-8.1-patches/ | library/security/openssl-11 | 1.1.1w | https://www.openssl.org/source/ -| library/security/openssl-3 | 3.1.4 | https://www.openssl.org/source/ +| library/security/openssl-3 | 3.1.5 | https://www.openssl.org/source/ | library/unixodbc | 2.3.12 | http://www.unixodbc.org/download.html | library/xxhash | 0.8.2 | https://github.com/Cyan4973/xxHash/releases | Currently used solely by rsync | library/zlib | 1.3.1 | https://www.zlib.net/ From 4a5b79bcbf17a495cb047d5d1c220cc6a23228f4 Mon Sep 17 00:00:00 2001 From: Andy Fiddaman Date: Tue, 30 Jan 2024 16:57:51 +0000 Subject: [PATCH 2/3] openssl11: backport fix for CVE-2024-0727 --- build/openssl/build-1.1.sh | 2 +- build/openssl/patches-1.1/CVE-2024-0727.patch | 110 ++++++++++++++++++ build/openssl/patches-1.1/series | 1 + build/openssl/testsuite-1.1.log | 2 +- 4 files changed, 113 insertions(+), 2 deletions(-) create mode 100644 build/openssl/patches-1.1/CVE-2024-0727.patch diff --git a/build/openssl/build-1.1.sh b/build/openssl/build-1.1.sh index ff240388fc..622daaaae8 100755 --- a/build/openssl/build-1.1.sh +++ b/build/openssl/build-1.1.sh @@ -13,7 +13,7 @@ # }}} # # Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved. -# Copyright 2023 OmniOS Community Edition (OmniOSce) Association. +# Copyright 2024 OmniOS Community Edition (OmniOSce) Association. # . ../../lib/build.sh . common.sh diff --git a/build/openssl/patches-1.1/CVE-2024-0727.patch b/build/openssl/patches-1.1/CVE-2024-0727.patch new file mode 100644 index 0000000000..1bbd4c17c2 --- /dev/null +++ b/build/openssl/patches-1.1/CVE-2024-0727.patch @@ -0,0 +1,110 @@ +From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Fri, 19 Jan 2024 11:28:58 +0000 +Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL + +PKCS12 structures contain PKCS7 ContentInfo fields. These fields are +optional and can be NULL even if the "type" is a valid value. OpenSSL +was not properly accounting for this and a NULL dereference can occur +causing a crash. + +CVE-2024-0727 + +Reviewed-by: Tomas Mraz +Reviewed-by: Hugo Landau +Reviewed-by: Neil Horman +(Merged from https://github.com/openssl/openssl/pull/23362) + +(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c) +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c +--- a~/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00 +@@ -76,6 +76,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p7->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); + } + +@@ -132,6 +139,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + { + if (!PKCS7_type_is_encrypted(p7)) + return NULL; ++ ++ if (p7->d.encrypted == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, + ASN1_ITEM_rptr(PKCS12_SAFEBAGS), + pass, passlen, +@@ -159,6 +173,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + } +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c +--- a~/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00 +@@ -93,6 +93,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, c + return 0; + } + ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR); ++ return 0; ++ } ++ + salt = p12->mac->salt->data; + saltlen = p12->mac->salt->length; + if (!p12->mac->iter) +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c +--- a~/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00 +@@ -78,7 +78,8 @@ static int newpass_p12(PKCS12 *p12, cons + bags = PKCS12_unpack_p7data(p7); + } else if (bagnid == NID_pkcs7_encrypted) { + bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); +- if (!alg_get(p7->d.encrypted->enc_data->algorithm, ++ if (p7->d.encrypted == NULL ++ || !alg_get(p7->d.encrypted->enc_data->algorithm, + &pbe_nid, &pbe_iter, &pbe_saltlen)) + goto err; + } else { +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c +--- a~/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00 +@@ -30,10 +30,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p + { + STACK_OF(X509_ALGOR) *mdalgs; + int ctype_nid = OBJ_obj2nid(p7->type); +- if (ctype_nid == NID_pkcs7_signed) ++ if (ctype_nid == NID_pkcs7_signed) { ++ if (p7->d.sign == NULL) ++ return 0; + mdalgs = p7->d.sign->md_algs; +- else ++ } else { + mdalgs = NULL; ++ } + + flags ^= SMIME_OLDMIME; + diff --git a/build/openssl/patches-1.1/series b/build/openssl/patches-1.1/series index 4676bd746e..fec88405c4 100644 --- a/build/openssl/patches-1.1/series +++ b/build/openssl/patches-1.1/series @@ -1 +1,2 @@ libs.patch +CVE-2024-0727.patch diff --git a/build/openssl/testsuite-1.1.log b/build/openssl/testsuite-1.1.log index 3e9a5b9747..6ced3e18a8 100644 --- a/build/openssl/testsuite-1.1.log +++ b/build/openssl/testsuite-1.1.log @@ -158,5 +158,5 @@ ../test/recipes/99-test_ecstress.t ................. ok ../test/recipes/99-test_fuzz.t ..................... ok All tests successful. -Files=159, Tests=2652, 322 wallclock secs ( 3.74 usr 1.20 sys + 159.52 cusr 129.48 csys = 293.94 CPU) +Files=159, Tests=2652, 332 wallclock secs ( 3.95 usr 1.14 sys + 167.14 cusr 132.00 csys = 304.23 CPU) Result: PASS From 284a4ec243fd6c9445e66e65decc295e4e433139 Mon Sep 17 00:00:00 2001 From: Andy Fiddaman Date: Tue, 30 Jan 2024 17:01:28 +0000 Subject: [PATCH 3/3] openssl10: backport fix for CVE-2024-0727 --- build/openssl/build-1.0.sh | 2 +- build/openssl/patches-1.0/CVE-2024-0727.patch | 110 ++++++++++++++++++ build/openssl/patches-1.0/series | 1 + 3 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 build/openssl/patches-1.0/CVE-2024-0727.patch diff --git a/build/openssl/build-1.0.sh b/build/openssl/build-1.0.sh index 8ed2d25db4..15257d98b6 100755 --- a/build/openssl/build-1.0.sh +++ b/build/openssl/build-1.0.sh @@ -13,7 +13,7 @@ # }}} # # Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved. -# Copyright 2023 OmniOS Community Edition (OmniOSce) Association. +# Copyright 2024 OmniOS Community Edition (OmniOSce) Association. # . ../../lib/build.sh . common.sh diff --git a/build/openssl/patches-1.0/CVE-2024-0727.patch b/build/openssl/patches-1.0/CVE-2024-0727.patch new file mode 100644 index 0000000000..ab3b0ad6be --- /dev/null +++ b/build/openssl/patches-1.0/CVE-2024-0727.patch @@ -0,0 +1,110 @@ +From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Fri, 19 Jan 2024 11:28:58 +0000 +Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL + +PKCS12 structures contain PKCS7 ContentInfo fields. These fields are +optional and can be NULL even if the "type" is a valid value. OpenSSL +was not properly accounting for this and a NULL dereference can occur +causing a crash. + +CVE-2024-0727 + +Reviewed-by: Tomas Mraz +Reviewed-by: Hugo Landau +Reviewed-by: Neil Horman +(Merged from https://github.com/openssl/openssl/pull/23362) + +(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c) +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c +--- a~/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00 +@@ -171,6 +171,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p7->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); + } + +@@ -226,6 +233,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + { + if (!PKCS7_type_is_encrypted(p7)) + return NULL; ++ ++ if (p7->d.encrypted == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, + ASN1_ITEM_rptr(PKCS12_SAFEBAGS), + pass, passlen, +@@ -253,6 +267,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + } +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c +--- a~/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00 +@@ -80,6 +80,11 @@ int PKCS12_gen_mac(PKCS12 *p12, const ch + return 0; + } + ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR); ++ return 0; ++ } ++ + salt = p12->mac->salt->data; + saltlen = p12->mac->salt->length; + if (!p12->mac->iter) +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c +--- a~/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00 +@@ -126,7 +126,8 @@ static int newpass_p12(PKCS12 *p12, cons + bags = PKCS12_unpack_p7data(p7); + } else if (bagnid == NID_pkcs7_encrypted) { + bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); +- if (!alg_get(p7->d.encrypted->enc_data->algorithm, ++ if (p7->d.encrypted == NULL ++ || !alg_get(p7->d.encrypted->enc_data->algorithm, + &pbe_nid, &pbe_iter, &pbe_saltlen)) + goto err; + } else { +diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c +--- a~/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00 ++++ a/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00 +@@ -78,10 +78,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p + { + STACK_OF(X509_ALGOR) *mdalgs; + int ctype_nid = OBJ_obj2nid(p7->type); +- if (ctype_nid == NID_pkcs7_signed) ++ if (ctype_nid == NID_pkcs7_signed) { ++ if (p7->d.sign == NULL) ++ return 0; + mdalgs = p7->d.sign->md_algs; +- else ++ } else { + mdalgs = NULL; ++ } + + flags ^= SMIME_OLDMIME; + diff --git a/build/openssl/patches-1.0/series b/build/openssl/patches-1.0/series index 461f3080f3..705c2ca349 100644 --- a/build/openssl/patches-1.0/series +++ b/build/openssl/patches-1.0/series @@ -19,3 +19,4 @@ CVE-2023-0465.patch CVE-2023-2650.patch CVE-2023-3446.patch CVE-2023-3817.patch +CVE-2024-0727.patch