diff options
Diffstat (limited to 'meta/recipes-devtools/python/python3/CVE-2022-37454.patch')
-rw-r--r-- | meta/recipes-devtools/python/python3/CVE-2022-37454.patch | 105 |
1 files changed, 0 insertions, 105 deletions
diff --git a/meta/recipes-devtools/python/python3/CVE-2022-37454.patch b/meta/recipes-devtools/python/python3/CVE-2022-37454.patch deleted file mode 100644 index a41cc301e2..0000000000 --- a/meta/recipes-devtools/python/python3/CVE-2022-37454.patch +++ /dev/null | |||
@@ -1,105 +0,0 @@ | |||
1 | From 948c6794711458fd148a3fa62296cadeeb2ed631 Mon Sep 17 00:00:00 2001 | ||
2 | From: "Miss Islington (bot)" | ||
3 | <31488909+miss-islington@users.noreply.github.com> | ||
4 | Date: Fri, 28 Oct 2022 03:07:50 -0700 | ||
5 | Subject: [PATCH] [3.8] gh-98517: Fix buffer overflows in _sha3 module | ||
6 | (GH-98519) (#98527) | ||
7 | |||
8 | This is a port of the applicable part of XKCP's fix [1] for | ||
9 | CVE-2022-37454 and avoids the segmentation fault and the infinite | ||
10 | loop in the test cases published in [2]. | ||
11 | |||
12 | [1]: https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a | ||
13 | [2]: https://mouha.be/sha-3-buffer-overflow/ | ||
14 | |||
15 | Regression test added by: Gregory P. Smith [Google LLC] <greg@krypto.org> | ||
16 | (cherry picked from commit 0e4e058602d93b88256ff90bbef501ba20be9dd3) | ||
17 | |||
18 | Co-authored-by: Theo Buehler <botovq@users.noreply.github.com> | ||
19 | |||
20 | CVE: CVE-2022-37454 | ||
21 | Upstream-Status: Backport [https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631] | ||
22 | Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> | ||
23 | --- | ||
24 | Lib/test/test_hashlib.py | 9 +++++++++ | ||
25 | .../2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst | 1 + | ||
26 | Modules/_sha3/kcp/KeccakSponge.inc | 15 ++++++++------- | ||
27 | 3 files changed, 18 insertions(+), 7 deletions(-) | ||
28 | create mode 100644 Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst | ||
29 | |||
30 | diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py | ||
31 | index 8b53d23ef525..e6cec4e306e5 100644 | ||
32 | --- a/Lib/test/test_hashlib.py | ||
33 | +++ b/Lib/test/test_hashlib.py | ||
34 | @@ -434,6 +434,15 @@ def test_case_md5_huge(self, size): | ||
35 | def test_case_md5_uintmax(self, size): | ||
36 | self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3') | ||
37 | |||
38 | + @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') | ||
39 | + @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) | ||
40 | + def test_sha3_update_overflow(self, size): | ||
41 | + """Regression test for gh-98517 CVE-2022-37454.""" | ||
42 | + h = hashlib.sha3_224() | ||
43 | + h.update(b'\x01') | ||
44 | + h.update(b'\x01'*0xffff_ffff) | ||
45 | + self.assertEqual(h.hexdigest(), '80762e8ce6700f114fec0f621fd97c4b9c00147fa052215294cceeed') | ||
46 | + | ||
47 | # use the three examples from Federal Information Processing Standards | ||
48 | # Publication 180-1, Secure Hash Standard, 1995 April 17 | ||
49 | # http://www.itl.nist.gov/div897/pubs/fip180-1.htm | ||
50 | diff --git a/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst b/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst | ||
51 | new file mode 100644 | ||
52 | index 000000000000..2d23a6ad93c7 | ||
53 | --- /dev/null | ||
54 | +++ b/Misc/NEWS.d/next/Security/2022-10-21-13-31-47.gh-issue-98517.SXXGfV.rst | ||
55 | @@ -0,0 +1 @@ | ||
56 | +Port XKCP's fix for the buffer overflows in SHA-3 (CVE-2022-37454). | ||
57 | diff --git a/Modules/_sha3/kcp/KeccakSponge.inc b/Modules/_sha3/kcp/KeccakSponge.inc | ||
58 | index e10739deafa8..cf92e4db4d36 100644 | ||
59 | --- a/Modules/_sha3/kcp/KeccakSponge.inc | ||
60 | +++ b/Modules/_sha3/kcp/KeccakSponge.inc | ||
61 | @@ -171,7 +171,7 @@ int SpongeAbsorb(SpongeInstance *instance, const unsigned char *data, size_t dat | ||
62 | i = 0; | ||
63 | curData = data; | ||
64 | while(i < dataByteLen) { | ||
65 | - if ((instance->byteIOIndex == 0) && (dataByteLen >= (i + rateInBytes))) { | ||
66 | + if ((instance->byteIOIndex == 0) && (dataByteLen-i >= rateInBytes)) { | ||
67 | #ifdef SnP_FastLoop_Absorb | ||
68 | /* processing full blocks first */ | ||
69 | |||
70 | @@ -199,10 +199,10 @@ int SpongeAbsorb(SpongeInstance *instance, const unsigned char *data, size_t dat | ||
71 | } | ||
72 | else { | ||
73 | /* normal lane: using the message queue */ | ||
74 | - | ||
75 | - partialBlock = (unsigned int)(dataByteLen - i); | ||
76 | - if (partialBlock+instance->byteIOIndex > rateInBytes) | ||
77 | + if (dataByteLen-i > rateInBytes-instance->byteIOIndex) | ||
78 | partialBlock = rateInBytes-instance->byteIOIndex; | ||
79 | + else | ||
80 | + partialBlock = (unsigned int)(dataByteLen - i); | ||
81 | #ifdef KeccakReference | ||
82 | displayBytes(1, "Block to be absorbed (part)", curData, partialBlock); | ||
83 | #endif | ||
84 | @@ -281,7 +281,7 @@ int SpongeSqueeze(SpongeInstance *instance, unsigned char *data, size_t dataByte | ||
85 | i = 0; | ||
86 | curData = data; | ||
87 | while(i < dataByteLen) { | ||
88 | - if ((instance->byteIOIndex == rateInBytes) && (dataByteLen >= (i + rateInBytes))) { | ||
89 | + if ((instance->byteIOIndex == rateInBytes) && (dataByteLen-i >= rateInBytes)) { | ||
90 | for(j=dataByteLen-i; j>=rateInBytes; j-=rateInBytes) { | ||
91 | SnP_Permute(instance->state); | ||
92 | SnP_ExtractBytes(instance->state, curData, 0, rateInBytes); | ||
93 | @@ -299,9 +299,10 @@ int SpongeSqueeze(SpongeInstance *instance, unsigned char *data, size_t dataByte | ||
94 | SnP_Permute(instance->state); | ||
95 | instance->byteIOIndex = 0; | ||
96 | } | ||
97 | - partialBlock = (unsigned int)(dataByteLen - i); | ||
98 | - if (partialBlock+instance->byteIOIndex > rateInBytes) | ||
99 | + if (dataByteLen-i > rateInBytes-instance->byteIOIndex) | ||
100 | partialBlock = rateInBytes-instance->byteIOIndex; | ||
101 | + else | ||
102 | + partialBlock = (unsigned int)(dataByteLen - i); | ||
103 | i += partialBlock; | ||
104 | |||
105 | SnP_ExtractBytes(instance->state, curData, instance->byteIOIndex, partialBlock); | ||