FYI... We'll be asking for a CVE for the issue. ---------- Forwarded message ---------- From: Gergely Nagy <[email protected]> Date: Mon, Dec 12, 2016 at 8:45 AM Subject: Security issue (DoS) in Crypto++ ASN1 decoder To: Jeffrey Walton <[email protected]> Cc: Tamás Koczka <[email protected]>
Hi! I have found a bug in several BERDecode* functions which could be used for a DoS attack. The issue is similar to CVE-2016-2109 in OpenSSL which was disclosed in https://www.openssl.org/news/secadv/20160503.txt Basically after the ASN1 decoder reads the length, it allocates a SecByteBlock of that size before checking that there is enough data available. This can cause memory exhaustion on most platforms, but it has (in my opinion) the worst effect on 64-bit Linux systems where the allocation will succeed for huge sizes and then a BERDecodeError exception will be thrown that causes the destructor of the SecByteBlock to be called, which can hang the CPU for a really long time zeroing out memory. I have attached a patch (for the current master branch) that fixes this behavior in both versions of BERDecodeOctetString, BERDecodeTextString, BERDecodeBitString and BERDecodeUnsigned. I am not 100% sure that there are no other places in the code with the same issue. I don't know how you want to disclose this issue, but if you want to assign a CVE number and release a new version before publicly disclosing it then we won't deploy our fix until then. We will binary patch our software which includes a statically linked Crypto++ after 30 days if we don't get a proper response. When you disclose the issue please refer to me as "Gergely Nagy (Tresorit)", and say that the bug was found using "honggfuzz". Thanks, Gergely Nagy (Tresorit) -- -- You received this message because you are subscribed to the "Crypto++ Users" Google Group. To unsubscribe, send an email to [email protected]. More information about Crypto++ and this group is available at http://www.cryptopp.com. --- You received this message because you are subscribed to the Google Groups "Crypto++ Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
