[openssl-commits] [openssl] OpenSSL_1_0_1-stable update

[Matt Caswell]

The branch OpenSSL_1_0_1-stable has been updated
       via  b11980d79a52ec08844f08bea0e66c04b691840b (commit)
       via  f15c99f4d4a96b692bdbb6f343c9112f2fa5a8ed (commit)
      from  507ea77b82f99af8cdae22bebb49fb2772d95330 (commit)


- Log -----------------------------------------------------------------
commit b11980d79a52ec08844f08bea0e66c04b691840b
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Aug 10 12:00:29 2015 +0100

    Check for 0 modulus in BN_MONT_CTX_set
    
    The function BN_MONT_CTX_set was assuming that the modulus was non-zero
    and therefore that |mod->top| > 0. In an error situation that may not be
    the case and could cause a seg fault.
    
    This is a follow on from CVE-2015-1794.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>

commit f15c99f4d4a96b692bdbb6f343c9112f2fa5a8ed
Author: Guy Leaver (guleaver) <guleaver at cisco.com>
Date:   Fri Aug 7 15:45:21 2015 +0100

    Fix seg fault with 0 p val in SKE
    
    If a client receives a ServerKeyExchange for an anon DH ciphersuite with the
    value of p set to 0 then a seg fault can occur. This commits adds a test to
    reject p, g and pub key parameters that have a 0 value (in accordance with
    RFC 5246)
    
    The security vulnerability only affects master and 1.0.2, but the fix is
    additionally applied to 1.0.1 for additional confidence.
    
    CVE-2015-1794
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    Reviewed-by: Matt Caswell <matt at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/bn/bn_mont.c |  3 +++
 ssl/s3_clnt.c       | 16 ++++++++++++++++
 ssl/ssl.h           |  3 +++
 ssl/ssl_err.c       |  3 +++
 4 files changed, 25 insertions(+)

diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c
index aafd1b8..be95bd5 100644
--- a/crypto/bn/bn_mont.c
+++ b/crypto/bn/bn_mont.c
@@ -373,6 +373,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
     int ret = 0;
     BIGNUM *Ri, *R;
 
+    if (BN_is_zero(mod))
+        return 0;
+
     BN_CTX_start(ctx);
     if ((Ri = BN_CTX_get(ctx)) == NULL)
         goto err;
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 35ad121..c89564b 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1624,6 +1624,12 @@ int ssl3_get_key_exchange(SSL *s)
         }
         p += i;
 
+        if (BN_is_zero(dh->p)) {
+            SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_DH_P_VALUE);
+            goto f_err;
+        }
+
+
         if (2 > n - param_len) {
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_LENGTH_TOO_SHORT);
             goto f_err;
@@ -1644,6 +1650,11 @@ int ssl3_get_key_exchange(SSL *s)
         }
         p += i;
 
+        if (BN_is_zero(dh->g)) {
+            SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_DH_G_VALUE);
+            goto f_err;
+        }
+
         if (2 > n - param_len) {
             SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_LENGTH_TOO_SHORT);
             goto f_err;
@@ -1665,6 +1676,11 @@ int ssl3_get_key_exchange(SSL *s)
         p += i;
         n -= param_len;
 
+        if (BN_is_zero(dh->pub_key)) {
+            SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_BAD_DH_PUB_KEY_VALUE);
+            goto f_err;
+        }
+
 # ifndef OPENSSL_NO_RSA
         if (alg_a & SSL_aRSA)
             pkey =
diff --git a/ssl/ssl.h b/ssl/ssl.h
index d2ab0c0..d9657eb 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -2465,8 +2465,11 @@ void ERR_load_SSL_strings(void);
 # define SSL_R_BAD_DATA_RETURNED_BY_CALLBACK              106
 # define SSL_R_BAD_DECOMPRESSION                          107
 # define SSL_R_BAD_DH_G_LENGTH                            108
+# define SSL_R_BAD_DH_G_VALUE                             375
 # define SSL_R_BAD_DH_PUB_KEY_LENGTH                      109
+# define SSL_R_BAD_DH_PUB_KEY_VALUE                       393
 # define SSL_R_BAD_DH_P_LENGTH                            110
+# define SSL_R_BAD_DH_P_VALUE                             395
 # define SSL_R_BAD_DIGEST_LENGTH                          111
 # define SSL_R_BAD_DSA_SIGNATURE                          112
 # define SSL_R_BAD_ECC_CERT                               304
diff --git a/ssl/ssl_err.c b/ssl/ssl_err.c
index 88621b7..26f149e 100644
--- a/ssl/ssl_err.c
+++ b/ssl/ssl_err.c
@@ -369,8 +369,11 @@ static ERR_STRING_DATA SSL_str_reasons[] = {
      "bad data returned by callback"},
     {ERR_REASON(SSL_R_BAD_DECOMPRESSION), "bad decompression"},
     {ERR_REASON(SSL_R_BAD_DH_G_LENGTH), "bad dh g length"},
+    {ERR_REASON(SSL_R_BAD_DH_G_VALUE), "bad dh g value"},
     {ERR_REASON(SSL_R_BAD_DH_PUB_KEY_LENGTH), "bad dh pub key length"},
+    {ERR_REASON(SSL_R_BAD_DH_PUB_KEY_VALUE), "bad dh pub key value"},
     {ERR_REASON(SSL_R_BAD_DH_P_LENGTH), "bad dh p length"},
+    {ERR_REASON(SSL_R_BAD_DH_P_VALUE), "bad dh p value"},
     {ERR_REASON(SSL_R_BAD_DIGEST_LENGTH), "bad digest length"},
     {ERR_REASON(SSL_R_BAD_DSA_SIGNATURE), "bad dsa signature"},
     {ERR_REASON(SSL_R_BAD_ECC_CERT), "bad ecc cert"},