The branch master has been updated via f47270e10b7ec18e5719bb2260a7d6460af387ac (commit) via 97652f0b3a557876462ef30373ac5eeeaa88b295 (commit) via 77d75993651b63e872244a3256e37967bb3c3e9e (commit) via 5630661aecbea5fe3c4740f5fea744a1f07a6253 (commit) from e1dd8fa00a1e06d27c8b024dac7657a8d8a9b451 (commit)
- Log ----------------------------------------------------------------- commit f47270e10b7ec18e5719bb2260a7d6460af387ac Author: Matt Caswell <m...@openssl.org> Date: Wed Dec 6 14:09:11 2017 +0000 Update CHANGES and NEWS for new release Reviewed-by: Rich Salz <rs...@openssl.org> commit 97652f0b3a557876462ef30373ac5eeeaa88b295 Author: Matt Caswell <m...@openssl.org> Date: Wed Nov 29 13:56:15 2017 +0000 Add a test for CVE-2017-3737 Test reading/writing to an SSL object after a fatal error has been detected. This CVE only affected 1.0.2, but we should add it to other branches for completeness. Reviewed-by: Viktor Dukhovni <vik...@openssl.org> commit 77d75993651b63e872244a3256e37967bb3c3e9e Author: Andy Polyakov <ap...@openssl.org> Date: Fri Nov 24 11:37:59 2017 +0100 test/bntest.c: add rsaz_1024_mul_avx2 regression test. Reviewed-by: Rich Salz <rs...@openssl.org> commit 5630661aecbea5fe3c4740f5fea744a1f07a6253 Author: Andy Polyakov <ap...@openssl.org> Date: Fri Nov 24 11:35:50 2017 +0100 bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2. Credit to OSS-Fuzz for finding this. CVE-2017-3738 Reviewed-by: Rich Salz <rs...@openssl.org> ----------------------------------------------------------------------- Summary of changes: CHANGES | 22 ++++++ NEWS | 4 + crypto/bn/asm/rsaz-avx2.pl | 15 ++-- test/bntest.c | 22 ++++++ test/build.info | 6 +- test/fatalerrtest.c | 89 ++++++++++++++++++++++ .../{90-test_sslapi.t => 90-test_fatalerr.t} | 6 +- 7 files changed, 152 insertions(+), 12 deletions(-) create mode 100644 test/fatalerrtest.c copy test/recipes/{90-test_sslapi.t => 90-test_fatalerr.t} (77%) diff --git a/CHANGES b/CHANGES index 3ae8b4d..cbae96d 100644 --- a/CHANGES +++ b/CHANGES @@ -190,6 +190,28 @@ issues, has been replaced to always returns NULL. [Rich Salz] + Changes between 1.1.0g and 1.1.0h [xx XXX xxxx] + + *) rsaz_1024_mul_avx2 overflow bug on x86_64 + + There is an overflow bug in the AVX2 Montgomery multiplication procedure + used in exponentiation with 1024-bit moduli. No EC algorithms are affected. + Analysis suggests that attacks against RSA and DSA as a result of this + defect would be very difficult to perform and are not believed likely. + Attacks against DH1024 are considered just feasible, because most of the + work necessary to deduce information about a private key may be performed + offline. The amount of resources required for such an attack would be + significant. However, for an attack on TLS to be meaningful, the server + would have to share the DH1024 private key among multiple clients, which is + no longer an option since CVE-2016-0701. + + This only affects processors that support the AVX2 but not ADX extensions + like Intel Haswell (4th generation). + + This issue was reported to OpenSSL by David Benjamin (Google). The issue + was originally found via the OSS-Fuzz project. + (CVE-2017-3738) + [Andy Polyakov] Changes between 1.1.0f and 1.1.0g [2 Nov 2017] diff --git a/NEWS b/NEWS index d102cb7..73a5a25 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,10 @@ o Add a STORE module (OSSL_STORE) o Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes + Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [under development] + + o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) + Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017] o bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) diff --git a/crypto/bn/asm/rsaz-avx2.pl b/crypto/bn/asm/rsaz-avx2.pl index f263901..8c56a91 100755 --- a/crypto/bn/asm/rsaz-avx2.pl +++ b/crypto/bn/asm/rsaz-avx2.pl @@ -217,7 +217,7 @@ $code.=<<___; vmovdqu 32*8-128($ap), $ACC8 lea 192(%rsp), $tp0 # 64+128=192 - vpbroadcastq .Land_mask(%rip), $AND_MASK + vmovdqu .Land_mask(%rip), $AND_MASK jmp .LOOP_GRANDE_SQR_1024 .align 32 @@ -1067,10 +1067,10 @@ $code.=<<___; vpmuludq 32*6-128($np),$Yi,$TEMP1 vpaddq $TEMP1,$ACC6,$ACC6 vpmuludq 32*7-128($np),$Yi,$TEMP2 - vpblendd \$3, $ZERO, $ACC9, $ACC9 # correct $ACC3 + vpblendd \$3, $ZERO, $ACC9, $TEMP1 # correct $ACC3 vpaddq $TEMP2,$ACC7,$ACC7 vpmuludq 32*8-128($np),$Yi,$TEMP0 - vpaddq $ACC9, $ACC3, $ACC3 # correct $ACC3 + vpaddq $TEMP1, $ACC3, $ACC3 # correct $ACC3 vpaddq $TEMP0,$ACC8,$ACC8 mov %rbx, %rax @@ -1083,7 +1083,9 @@ $code.=<<___; vmovdqu -8+32*2-128($ap),$TEMP2 mov $r1, %rax + vpblendd \$0xfc, $ZERO, $ACC9, $ACC9 # correct $ACC3 imull $n0, %eax + vpaddq $ACC9,$ACC4,$ACC4 # correct $ACC3 and \$0x1fffffff, %eax imulq 16-128($ap),%rbx @@ -1319,15 +1321,12 @@ ___ # But as we underutilize resources, it's possible to correct in # each iteration with marginal performance loss. But then, as # we do it in each iteration, we can correct less digits, and -# avoid performance penalties completely. Also note that we -# correct only three digits out of four. This works because -# most significant digit is subjected to less additions. +# avoid performance penalties completely. $TEMP0 = $ACC9; $TEMP3 = $Bi; $TEMP4 = $Yi; $code.=<<___; - vpermq \$0, $AND_MASK, $AND_MASK vpaddq (%rsp), $TEMP1, $ACC0 vpsrlq \$29, $ACC0, $TEMP1 @@ -1774,7 +1773,7 @@ $code.=<<___; .align 64 .Land_mask: - .quad 0x1fffffff,0x1fffffff,0x1fffffff,-1 + .quad 0x1fffffff,0x1fffffff,0x1fffffff,0x1fffffff .Lscatter_permd: .long 0,2,4,6,7,7,7,7 .Lgather_permd: diff --git a/test/bntest.c b/test/bntest.c index 9eda5bd..fc3d075 100644 --- a/test/bntest.c +++ b/test/bntest.c @@ -425,6 +425,28 @@ static int test_modexp_mont5(void) if (!TEST_BN_eq(c, d)) goto err; + /* Regression test for bug in rsaz_1024_mul_avx2 */ + BN_hex2bn(&a, + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020DF"); + BN_hex2bn(&b, + "2020202020202020202020202020202020202020202020202020202020202020" + "2020202020202020202020202020202020202020202020202020202020202020" + "20202020202020FF202020202020202020202020202020202020202020202020" + "2020202020202020202020202020202020202020202020202020202020202020"); + BN_hex2bn(&n, + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2020202020FF"); + BN_MONT_CTX_set(mont, n, ctx); + BN_mod_exp_mont_consttime(c, a, b, n, ctx, mont); + BN_mod_exp_mont(d, a, b, n, ctx, mont); + if (!TEST_BN_eq(c, d)) + goto err; + /* Zero input */ BN_bntest_rand(p, 1024, 0, 0); BN_zero(a); diff --git a/test/build.info b/test/build.info index 3d7af31..3c92c80 100644 --- a/test/build.info +++ b/test/build.info @@ -46,7 +46,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN x509_time_test x509_dup_cert_test x509_check_cert_pkey_test \ recordlentest drbgtest sslbuffertest \ time_offset_test pemtest ssl_cert_table_internal_test ciphername_test \ - servername_test ocspapitest rsa_mp_test + servername_test ocspapitest rsa_mp_test fatalerrtest SOURCE[aborttest]=aborttest.c INCLUDE[aborttest]=../include @@ -156,6 +156,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN INCLUDE[rsa_mp_test]=.. ../include DEPEND[rsa_mp_test]=../libcrypto libtestutil.a + SOURCE[fatalerrtest]=fatalerrtest.c ssltestlib.c + INCLUDE[fatalerrtest]=../include .. + DEPEND[fatalerrtest]=../libcrypto ../libssl libtestutil.a + SOURCE[evp_test]=evp_test.c INCLUDE[evp_test]=../include DEPEND[evp_test]=../libcrypto libtestutil.a diff --git a/test/fatalerrtest.c b/test/fatalerrtest.c new file mode 100644 index 0000000..fe2071f --- /dev/null +++ b/test/fatalerrtest.c @@ -0,0 +1,89 @@ +/* + * Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include <openssl/ssl.h> +#include <openssl/err.h> +#include "ssltestlib.h" +#include "testutil.h" +#include <string.h> + +static char *cert = NULL; +static char *privkey = NULL; + +static int test_fatalerr(void) +{ + SSL_CTX *sctx = NULL, *cctx = NULL; + SSL *sssl = NULL, *cssl = NULL; + const char *msg = "Dummy"; + BIO *wbio = NULL; + int ret = 0, len; + char buf[80]; + unsigned char dummyrec[] = { + 0x17, 0x03, 0x03, 0x00, 0x05, 'D', 'u', 'm', 'm', 'y' + }; + + if (!TEST_true(create_ssl_ctx_pair(TLS_method(), TLS_method(), &sctx, &cctx, + cert, privkey))) + goto err; + + /* + * Deliberately set the cipher lists for client and server to be different + * to force a handshake failure. + */ + if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "AES128-SHA")) + || !TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-SHA")) + || !TEST_true(create_ssl_objects(sctx, cctx, &sssl, &cssl, NULL, + NULL))) + goto err; + + wbio = SSL_get_wbio(cssl); + if (!TEST_ptr(wbio)) { + printf("Unexpected NULL bio received\n"); + goto err; + } + + /* Connection should fail */ + if (!TEST_false(create_ssl_connection(sssl, cssl, SSL_ERROR_NONE))) + goto err; + + ERR_clear_error(); + + /* Inject a plaintext record from client to server */ + if (!TEST_int_gt(BIO_write(wbio, dummyrec, sizeof(dummyrec)), 0)) + goto err; + + /* SSL_read()/SSL_write should fail because of a previous fatal error */ + if (!TEST_int_le(len = SSL_read(sssl, buf, sizeof(buf - 1)), 0)) { + buf[len] = '\0'; + TEST_error("Unexpected success reading data: %s\n", buf); + goto err; + } + if (!TEST_int_le(SSL_write(sssl, msg, strlen(msg)), 0)) + goto err; + + ret = 1; + err: + SSL_free(sssl); + SSL_free(cssl); + SSL_CTX_free(sctx); + SSL_CTX_free(cctx); + + return ret; +} + +int setup_tests(void) +{ + if (!TEST_ptr(cert = test_get_argument(0)) + || !TEST_ptr(privkey = test_get_argument(1))) + return 0; + + ADD_TEST(test_fatalerr); + + return 1; +} diff --git a/test/recipes/90-test_sslapi.t b/test/recipes/90-test_fatalerr.t similarity index 77% copy from test/recipes/90-test_sslapi.t copy to test/recipes/90-test_fatalerr.t index efaae3b..361bc1f 100644 --- a/test/recipes/90-test_sslapi.t +++ b/test/recipes/90-test_fatalerr.t @@ -10,12 +10,12 @@ use OpenSSL::Test::Utils; use OpenSSL::Test qw/:DEFAULT srctop_file/; -setup("test_sslapi"); +setup("test_fatalerr"); plan skip_all => "No TLS/SSL protocols are supported by this OpenSSL build" if alldisabled(grep { $_ ne "ssl3" } available_protocols("tls")); plan tests => 1; -ok(run(test(["sslapitest", srctop_file("apps", "server.pem"), - srctop_file("apps", "server.pem")])), "running sslapitest"); +ok(run(test(["fatalerrtest", srctop_file("apps", "server.pem"), + srctop_file("apps", "server.pem")])), "running fatalerrtest"); _____ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits