Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix DH_check() excessive time with oversized modulus #1109

Merged
merged 5 commits into from
Jul 21, 2023
Merged

Fix DH_check() excessive time with oversized modulus #1109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
648762f
Fix DH_check() excessive time with oversized modulus
skmcgrail Jul 19, 2023
f18a781
Add test case
skmcgrail Jul 20, 2023
6e770f5
Fix comment
skmcgrail Jul 20, 2023
02ab652
Merge branch 'main' into CVE-2023-3446
skmcgrail Jul 21, 2023
991bf96
Merge branch 'main' into CVE-2023-3446
skmcgrail Jul 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions crypto/dh_extra/dh_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,33 @@ TEST(DHTest, Basic) {
EXPECT_GE(key1.size(), 4u);
}

TEST(DHTest, OversizedModulus) {
bssl::UniquePtr<DH> a(DH_new());
ASSERT_TRUE(a);

const size_t LARGE_MOD_P = 4097; // OPENSSL_DH_CHECK_MAX_MODULUS_BITS / 8 + 1

// Create a BigNumber which will be interpreted as a big-endian value
auto number = std::unique_ptr<uint8_t[], std::default_delete<uint8_t[]>>(
new uint8_t[LARGE_MOD_P]);
for (size_t i = 0; i < LARGE_MOD_P; i++) {
number[i] = 255;
}

bssl::UniquePtr<BIGNUM> p(BN_bin2bn(number.get(), LARGE_MOD_P, nullptr));
bssl::UniquePtr<BIGNUM> q(BN_new());
bssl::UniquePtr<BIGNUM> g(BN_new());

// Q and G don't matter for this test, they just can't be null
ASSERT_TRUE(DH_set0_pqg(a.get(), p.release(), q.release(), g.release()));

int check_result;
ASSERT_FALSE(DH_check(a.get(), &check_result));
uint32_t error = ERR_get_error();
ASSERT_EQ(ERR_LIB_DH, ERR_GET_LIB(error));
ASSERT_EQ(DH_R_MODULUS_TOO_LARGE, ERR_GET_REASON(error));
}

// The following parameters are taken from RFC 5114, section 2.2. This is not a
// safe prime. Do not use these parameters.
static const uint8_t kRFC5114_2048_224P[] = {
Expand Down
8 changes: 8 additions & 0 deletions crypto/fipsmodule/dh/check.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@

#include "internal.h"

#define OPENSSL_DH_CHECK_MAX_MODULUS_BITS 32768
justsmth marked this conversation as resolved.
Show resolved Hide resolved

int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *out_flags) {
*out_flags = 0;
Expand Down Expand Up @@ -125,6 +126,13 @@ int DH_check(const DH *dh, int *out_flags) {
BIGNUM *t1 = NULL, *t2 = NULL;

*out_flags = 0;

/* Don't do any checks at all with an excessively large modulus */
skmcgrail marked this conversation as resolved.
Show resolved Hide resolved
if (BN_num_bits(dh->p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
OPENSSL_PUT_ERROR(DH, DH_R_MODULUS_TOO_LARGE);
return 0;
}

ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
Expand Down