summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch226
-rw-r--r--meta/recipes-connectivity/openssl/openssl_3.1.0.bb1
2 files changed, 227 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch
new file mode 100644
index 0000000000..33b0bb6c79
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/CVE-2023-0464.patch
@@ -0,0 +1,226 @@
1From 2017771e2db3e2b96f89bbe8766c3209f6a99545 Mon Sep 17 00:00:00 2001
2From: Pauli <pauli@openssl.org>
3Date: Wed, 8 Mar 2023 15:28:20 +1100
4Subject: [PATCH] x509: excessive resource use verifying policy constraints
5
6A security vulnerability has been identified in all supported versions
7of OpenSSL related to the verification of X.509 certificate chains
8that include policy constraints. Attackers may be able to exploit this
9vulnerability by creating a malicious certificate chain that triggers
10exponential use of computational resources, leading to a denial-of-service
11(DoS) attack on affected systems.
12
13Fixes CVE-2023-0464
14
15Reviewed-by: Tomas Mraz <tomas@openssl.org>
16Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
17(Merged from https://github.com/openssl/openssl/pull/20570)
18
19Upstream-Status: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545]
20CVE: CVE-2023-0464
21Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
22
23---
24 crypto/x509/pcy_local.h | 8 +++++++-
25 crypto/x509/pcy_node.c | 12 +++++++++---
26 crypto/x509/pcy_tree.c | 36 ++++++++++++++++++++++++++----------
27 3 files changed, 42 insertions(+), 14 deletions(-)
28
29diff --git a/crypto/x509/pcy_local.h b/crypto/x509/pcy_local.h
30index 18b53cc..cba107c 100644
31--- a/crypto/x509/pcy_local.h
32+++ b/crypto/x509/pcy_local.h
33@@ -111,6 +111,11 @@ struct X509_POLICY_LEVEL_st {
34 };
35
36 struct X509_POLICY_TREE_st {
37+ /* The number of nodes in the tree */
38+ size_t node_count;
39+ /* The maximum number of nodes in the tree */
40+ size_t node_maximum;
41+
42 /* This is the tree 'level' data */
43 X509_POLICY_LEVEL *levels;
44 int nlevel;
45@@ -157,7 +162,8 @@ X509_POLICY_NODE *ossl_policy_tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
46 X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
47 X509_POLICY_DATA *data,
48 X509_POLICY_NODE *parent,
49- X509_POLICY_TREE *tree);
50+ X509_POLICY_TREE *tree,
51+ int extra_data);
52 void ossl_policy_node_free(X509_POLICY_NODE *node);
53 int ossl_policy_node_match(const X509_POLICY_LEVEL *lvl,
54 const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
55diff --git a/crypto/x509/pcy_node.c b/crypto/x509/pcy_node.c
56index 9d9a7ea..450f95a 100644
57--- a/crypto/x509/pcy_node.c
58+++ b/crypto/x509/pcy_node.c
59@@ -59,10 +59,15 @@ X509_POLICY_NODE *ossl_policy_level_find_node(const X509_POLICY_LEVEL *level,
60 X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
61 X509_POLICY_DATA *data,
62 X509_POLICY_NODE *parent,
63- X509_POLICY_TREE *tree)
64+ X509_POLICY_TREE *tree,
65+ int extra_data)
66 {
67 X509_POLICY_NODE *node;
68
69+ /* Verify that the tree isn't too large. This mitigates CVE-2023-0464 */
70+ if (tree->node_maximum > 0 && tree->node_count >= tree->node_maximum)
71+ return NULL;
72+
73 node = OPENSSL_zalloc(sizeof(*node));
74 if (node == NULL) {
75 ERR_raise(ERR_LIB_X509V3, ERR_R_MALLOC_FAILURE);
76@@ -70,7 +75,7 @@ X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
77 }
78 node->data = data;
79 node->parent = parent;
80- if (level) {
81+ if (level != NULL) {
82 if (OBJ_obj2nid(data->valid_policy) == NID_any_policy) {
83 if (level->anyPolicy)
84 goto node_error;
85@@ -90,7 +95,7 @@ X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
86 }
87 }
88
89- if (tree) {
90+ if (extra_data) {
91 if (tree->extra_data == NULL)
92 tree->extra_data = sk_X509_POLICY_DATA_new_null();
93 if (tree->extra_data == NULL){
94@@ -103,6 +108,7 @@ X509_POLICY_NODE *ossl_policy_level_add_node(X509_POLICY_LEVEL *level,
95 }
96 }
97
98+ tree->node_count++;
99 if (parent)
100 parent->nchild++;
101
102diff --git a/crypto/x509/pcy_tree.c b/crypto/x509/pcy_tree.c
103index fa45da5..f953a05 100644
104--- a/crypto/x509/pcy_tree.c
105+++ b/crypto/x509/pcy_tree.c
106@@ -14,6 +14,17 @@
107
108 #include "pcy_local.h"
109
110+/*
111+ * If the maximum number of nodes in the policy tree isn't defined, set it to
112+ * a generous default of 1000 nodes.
113+ *
114+ * Defining this to be zero means unlimited policy tree growth which opens the
115+ * door on CVE-2023-0464.
116+ */
117+#ifndef OPENSSL_POLICY_TREE_NODES_MAX
118+# define OPENSSL_POLICY_TREE_NODES_MAX 1000
119+#endif
120+
121 static void expected_print(BIO *channel,
122 X509_POLICY_LEVEL *lev, X509_POLICY_NODE *node,
123 int indent)
124@@ -163,6 +174,9 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
125 return X509_PCY_TREE_INTERNAL;
126 }
127
128+ /* Limit the growth of the tree to mitigate CVE-2023-0464 */
129+ tree->node_maximum = OPENSSL_POLICY_TREE_NODES_MAX;
130+
131 /*
132 * http://tools.ietf.org/html/rfc5280#section-6.1.2, figure 3.
133 *
134@@ -180,7 +194,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
135 if ((data = ossl_policy_data_new(NULL,
136 OBJ_nid2obj(NID_any_policy), 0)) == NULL)
137 goto bad_tree;
138- if (ossl_policy_level_add_node(level, data, NULL, tree) == NULL) {
139+ if (ossl_policy_level_add_node(level, data, NULL, tree, 1) == NULL) {
140 ossl_policy_data_free(data);
141 goto bad_tree;
142 }
143@@ -239,7 +253,8 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
144 * Return value: 1 on success, 0 otherwise
145 */
146 static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr,
147- X509_POLICY_DATA *data)
148+ X509_POLICY_DATA *data,
149+ X509_POLICY_TREE *tree)
150 {
151 X509_POLICY_LEVEL *last = curr - 1;
152 int i, matched = 0;
153@@ -249,13 +264,13 @@ static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr,
154 X509_POLICY_NODE *node = sk_X509_POLICY_NODE_value(last->nodes, i);
155
156 if (ossl_policy_node_match(last, node, data->valid_policy)) {
157- if (ossl_policy_level_add_node(curr, data, node, NULL) == NULL)
158+ if (ossl_policy_level_add_node(curr, data, node, tree, 0) == NULL)
159 return 0;
160 matched = 1;
161 }
162 }
163 if (!matched && last->anyPolicy) {
164- if (ossl_policy_level_add_node(curr, data, last->anyPolicy, NULL) == NULL)
165+ if (ossl_policy_level_add_node(curr, data, last->anyPolicy, tree, 0) == NULL)
166 return 0;
167 }
168 return 1;
169@@ -268,7 +283,8 @@ static int tree_link_matching_nodes(X509_POLICY_LEVEL *curr,
170 * Return value: 1 on success, 0 otherwise.
171 */
172 static int tree_link_nodes(X509_POLICY_LEVEL *curr,
173- const X509_POLICY_CACHE *cache)
174+ const X509_POLICY_CACHE *cache,
175+ X509_POLICY_TREE *tree)
176 {
177 int i;
178
179@@ -276,7 +292,7 @@ static int tree_link_nodes(X509_POLICY_LEVEL *curr,
180 X509_POLICY_DATA *data = sk_X509_POLICY_DATA_value(cache->data, i);
181
182 /* Look for matching nodes in previous level */
183- if (!tree_link_matching_nodes(curr, data))
184+ if (!tree_link_matching_nodes(curr, data, tree))
185 return 0;
186 }
187 return 1;
188@@ -307,7 +323,7 @@ static int tree_add_unmatched(X509_POLICY_LEVEL *curr,
189 /* Curr may not have anyPolicy */
190 data->qualifier_set = cache->anyPolicy->qualifier_set;
191 data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
192- if (ossl_policy_level_add_node(curr, data, node, tree) == NULL) {
193+ if (ossl_policy_level_add_node(curr, data, node, tree, 1) == NULL) {
194 ossl_policy_data_free(data);
195 return 0;
196 }
197@@ -370,7 +386,7 @@ static int tree_link_any(X509_POLICY_LEVEL *curr,
198 /* Finally add link to anyPolicy */
199 if (last->anyPolicy &&
200 ossl_policy_level_add_node(curr, cache->anyPolicy,
201- last->anyPolicy, NULL) == NULL)
202+ last->anyPolicy, tree, 0) == NULL)
203 return 0;
204 return 1;
205 }
206@@ -553,7 +569,7 @@ static int tree_calculate_user_set(X509_POLICY_TREE *tree,
207 extra->flags = POLICY_DATA_FLAG_SHARED_QUALIFIERS
208 | POLICY_DATA_FLAG_EXTRA_NODE;
209 node = ossl_policy_level_add_node(NULL, extra, anyPolicy->parent,
210- tree);
211+ tree, 1);
212 }
213 if (!tree->user_policies) {
214 tree->user_policies = sk_X509_POLICY_NODE_new_null();
215@@ -580,7 +596,7 @@ static int tree_evaluate(X509_POLICY_TREE *tree)
216
217 for (i = 1; i < tree->nlevel; i++, curr++) {
218 cache = ossl_policy_cache_set(curr->cert);
219- if (!tree_link_nodes(curr, cache))
220+ if (!tree_link_nodes(curr, cache, tree))
221 return X509_PCY_TREE_INTERNAL;
222
223 if (!(curr->flags & X509_V_FLAG_INHIBIT_ANY)
224--
2252.25.1
226
diff --git a/meta/recipes-connectivity/openssl/openssl_3.1.0.bb b/meta/recipes-connectivity/openssl/openssl_3.1.0.bb
index 85286a0618..b319c66044 100644
--- a/meta/recipes-connectivity/openssl/openssl_3.1.0.bb
+++ b/meta/recipes-connectivity/openssl/openssl_3.1.0.bb
@@ -12,6 +12,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
12 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ 12 file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
13 file://0001-Configure-do-not-tweak-mips-cflags.patch \ 13 file://0001-Configure-do-not-tweak-mips-cflags.patch \
14 file://fix_random_labels.patch \ 14 file://fix_random_labels.patch \
15 file://CVE-2023-0464.patch \
15 " 16 "
16 17
17SRC_URI:append:class-nativesdk = " \ 18SRC_URI:append:class-nativesdk = " \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-04 15:59:20 +0000