[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YsNKzWyfLpY3Bt6+@itl-email>
Date: Mon, 4 Jul 2022 16:17:17 -0400
From: Demi Marie Obenour <demi@...isiblethingslab.com>
To: Open Source Software Security <oss-security@...ts.openwall.com>
Subject: Re: Denial of service in GnuPG
It has come to my attention that my original post caused at least two
mail clients to hang. Sorry about that; I did not expect any mail
client to eagerly parse the attachments. This version wraps the
attachments in a password-protected zip file (password: MitB7vqh). It
also includes some additional information.
GnuPG is vulnerable to a denial of service attack when processing
crafted detached signatures and/or certificates. By concatenating the
same signature to itself a very large number of times, and then wrapping
them in a compressed packet, I am able to cause GnuPG to take over a
minute to process an input that is less than 5KB armored.
I have attached two files:
- A patch (based on one submitted upstream) that fixes the bug for keys,
detached signatures, and cleartext signatures. It does not fix the
bug for other types of OpenPGP data, as I am not sure if the obvious
fix (only allowing a single literal data packet in a compressed
packet) would render data already in the wild inaccessible. The only
difference between this patch and the one sent upstream already is that
this one prevents attacks involving cleartext signatures.
- An encrypted zip file (see above for password) that contains a proof
of concept exploit. Both the public key and the detached signature
(of an empty file) are included.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
View attachment "v3-0001-Disallow-compressed-signatures-and-certificates.patch" of type "text/plain" (8134 bytes)
Download attachment "gnupg-dos.zip" of type "application/zip" (4070 bytes)
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
