summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2016-09-23 23:18:57 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-09-27 09:05:57 +0100
commit2b330e5439caa75387dafa90c0315e0fa693eec9 (patch)
treed517ec48ddedc9fcf827a97bdfeb09ad8a7c2d39
parente08094e604caf1fceb1fba7a4cae0f1937ffe7ef (diff)
downloadpoky-2b330e5439caa75387dafa90c0315e0fa693eec9.tar.gz
openssl: Security fix CVE-2016-6306
affects openssl < 1.0.1i (From OE-Core rev: 378e58a93127cbf7c330aa1ae4df9a96681bc410) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch71
-rw-r--r--meta/recipes-connectivity/openssl/openssl_1.0.2h.bb1
2 files changed, 72 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch
new file mode 100644
index 0000000000..9e7d576829
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch
@@ -0,0 +1,71 @@
1From ff553f837172ecb2b5c8eca257ec3c5619a4b299 Mon Sep 17 00:00:00 2001
2From: "Dr. Stephen Henson" <steve@openssl.org>
3Date: Sat, 17 Sep 2016 12:36:58 +0100
4Subject: [PATCH] Fix small OOB reads.
5
6In ssl3_get_client_certificate, ssl3_get_server_certificate and
7ssl3_get_certificate_request check we have enough room
8before reading a length.
9
10Thanks to Shi Lei (Gear Team, Qihoo 360 Inc.) for reporting these bugs.
11
12CVE-2016-6306
13
14Reviewed-by: Richard Levitte <levitte@openssl.org>
15Reviewed-by: Matt Caswell <matt@openssl.org>
16
17Upstream-Status: Backport
18CVE: CVE-2016-6306
19Signed-off-by: Armin Kuster <akuster@mvista.com>
20
21---
22 ssl/s3_clnt.c | 11 +++++++++++
23 ssl/s3_srvr.c | 6 ++++++
24 2 files changed, 17 insertions(+)
25
26Index: openssl-1.0.2h/ssl/s3_clnt.c
27===================================================================
28--- openssl-1.0.2h.orig/ssl/s3_clnt.c
29+++ openssl-1.0.2h/ssl/s3_clnt.c
30@@ -1216,6 +1216,12 @@ int ssl3_get_server_certificate(SSL *s)
31 goto f_err;
32 }
33 for (nc = 0; nc < llen;) {
34+ if (nc + 3 > llen) {
35+ al = SSL_AD_DECODE_ERROR;
36+ SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
37+ SSL_R_CERT_LENGTH_MISMATCH);
38+ goto f_err;
39+ }
40 n2l3(p, l);
41 if ((l + nc + 3) > llen) {
42 al = SSL_AD_DECODE_ERROR;
43@@ -2167,6 +2173,11 @@ int ssl3_get_certificate_request(SSL *s)
44 }
45
46 for (nc = 0; nc < llen;) {
47+ if (nc + 2 > llen) {
48+ ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
49+ SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, SSL_R_CA_DN_TOO_LONG);
50+ goto err;
51+ }
52 n2s(p, l);
53 if ((l + nc + 2) > llen) {
54 if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
55Index: openssl-1.0.2h/ssl/s3_srvr.c
56===================================================================
57--- openssl-1.0.2h.orig/ssl/s3_srvr.c
58+++ openssl-1.0.2h/ssl/s3_srvr.c
59@@ -3213,6 +3213,12 @@ int ssl3_get_client_certificate(SSL *s)
60 goto f_err;
61 }
62 for (nc = 0; nc < llen;) {
63+ if (nc + 3 > llen) {
64+ al = SSL_AD_DECODE_ERROR;
65+ SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,
66+ SSL_R_CERT_LENGTH_MISMATCH);
67+ goto f_err;
68+ }
69 n2l3(p, l);
70 if ((l + nc + 3) > llen) {
71 al = SSL_AD_DECODE_ERROR;
diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb b/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
index a12f59d18a..5a4e52a4d7 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
@@ -48,6 +48,7 @@ SRC_URI += "file://find.pl;subdir=${BP}/util/ \
48 file://CVE-2016-6302.patch \ 48 file://CVE-2016-6302.patch \
49 file://CVE-2016-6303.patch \ 49 file://CVE-2016-6303.patch \
50 file://CVE-2016-6304.patch \ 50 file://CVE-2016-6304.patch \
51 file://CVE-2016-6306.patch \
51 " 52 "
52SRC_URI[md5sum] = "9392e65072ce4b614c1392eefc1f23d0" 53SRC_URI[md5sum] = "9392e65072ce4b614c1392eefc1f23d0"
53SRC_URI[sha256sum] = "1d4007e53aad94a5b2002fe045ee7bb0b3d98f1a47f8b2bc851dcd1c74332919" 54SRC_URI[sha256sum] = "1d4007e53aad94a5b2002fe045ee7bb0b3d98f1a47f8b2bc851dcd1c74332919"