[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 20 Aug 2016 14:06:42 +0000
From: Pascal Cuoq <cuoq@...st-in-soft.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: "wk@...pg.org" <wk@...pg.org>, Raphaël Rieu-Helft
<raphael.rieu-helft@...st-in-soft.com>
Subject: memory issues in libksba 1.3.4 and git
Hello all,
this GitHub commit illustrates a memory issue present in in libksba 1.3.4 and in the current git tree from git://git.gnupg.org/libksba.git :
https://github.com/pascal-cuoq/libksba-fork/commit/709642767fbf7f2030d89bca4e4b192d612400ae
In summary:
Executing “tests/cert-basic long_time.crt” allocates a disproportionate 33MB of memory. In the current libksba git snapshot, this memory is initialized to zero, which takes a couple of milliseconds (probably mostly spent handling pagefaults), which is more than it should take to parse a certificate of a few hundred bytes on a modern computer. In version 1.3.4, the memory is left uninitialized, so no time is wasted. The commit that causes the memory to be initialized is https://github.com/pascal-cuoq/libksba-fork/commit/2a9fc5654df497b91ab9b64e946c1e19371888e5 and this commit was applied to prevent uninitialized memory from being incorporated into computations.
Executing “tests/cert-basic 90s.crt” allocates 60146387817 bytes (60GB). In the current libksba git snapshot, initializing this memory takes several seconds.
Executing “tests/cert-basic 0.0.0.0.0.crt” allocates 3MB of memory, which are either left uninitialized (1.3.4 version) or initialized to zero (git version). A large part of this memory is then converted to an “AuthorityKeyIdentifier”. In the git version, this produces a long sequence of 0.0.0.0... In version 1.3.4, since it's uninitialized memory that is used, the sequence may look different, and may contain secrets. “Secrets” here include cryptographic secrets that would unhygienically have been left in a freed memory block, but also addresses of variables, of library functions, etc. that might make another vulnerability exploitable.
These inputs have been set to Werner Koch, privately as per his request, on May 25, June 11 and July 11. I am publishing them now so that anyone who uses or might want to use libksba to parse messages (received pre-authentification by definition) can make an informed choice considering the risks of denial of service and information leak.
The inputs were found and kindly placed in the “hangs” result directory by afl-fuzz. The undefined behaviors caused by the inputs were investigated with tis-interpreter and a dependency analysis prototype developed by Raphaël Rieu-Helft. The results shown in https://github.com/pascal-cuoq/libksba-fork/blob/master/log were obtained by running ./autogen.sh, ./configure and make to build an instrumented version of libksba on a 128GiB Linux workstation (Ubuntu 16.04).
Pascal
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
