From 874cecdf09df9f534fa869fc8d4c3bb62f93c1fcf7d8ad6e4e46073b153a5e55 Mon Sep 17 00:00:00 2001 From: Martin Pluskal Date: Tue, 29 Sep 2020 05:57:17 +0000 Subject: [PATCH] Accepting request 837996 from home:dirkmueller:branches:security:tls - update to 2.24.0: * see https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 * Fix a vulnerability in the verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify()) with the actual certificate name: when the subjecAltName extension is present, the expected name was compared to any name in that extension regardless of its type. This means that an attacker could for example impersonate a 4-bytes or 16-byte domain by getting a certificate for the corresponding IPv4 or IPv6 (this would require the attacker to control that IP address, though). Similar attacks using other subjectAltName name types might be possible. * When checking X.509 CRLs, a certificate was only considered as revoked if its revocationDate was in the past according to the local clock if available. In particular, on builds without MBEDTLS_HAVE_TIME_DATE, certificates were never considered as revoked. On builds with MBEDTLS_HAVE_TIME_DATE, an attacker able to control the local clock (for example, an untrusted OS attacking a secure enclave) could prevent revocation of certificates via CRLs. Fixed by no longer checking the revocationDate field, in accordance with RFC 5280. Reported by yuemonangong in #3340. Reported independently and fixed by Raoul Strackx and Jethro * In (D)TLS record decryption, when using a CBC ciphersuites without the Encrypt-then-Mac extension, use constant code flow memory access patterns to extract and check the MAC. This is an improvement to the existing countermeasure against Lucky 13 attacks. The previous countermeasure was effective against network-based attackers, but less so against local attackers. The new countermeasure defends against local attackers, even if they have access to fine-grained measurements. In particular, this fixes a local Lucky 13 cache attack found and reported by Tuba Yavuz, Farhaan Fowze, Ken (Yihan) Bai, Grant Hernandez, and Kevin Butler (University of Florida) and Dave Tian (Purdue University). OBS-URL: https://build.opensuse.org/request/show/837996 OBS-URL: https://build.opensuse.org/package/show/security:tls/mbedtls?expand=0&rev=20 --- mbedtls.changes | 44 ++++++++++++++++++++++++++++++++++++++++++++ mbedtls.spec | 2 +- v2.23.0.tar.gz | 3 --- v2.24.0.tar.gz | 3 +++ 4 files changed, 48 insertions(+), 4 deletions(-) delete mode 100644 v2.23.0.tar.gz create mode 100644 v2.24.0.tar.gz diff --git a/mbedtls.changes b/mbedtls.changes index e558012..9fca37d 100644 --- a/mbedtls.changes +++ b/mbedtls.changes @@ -1,3 +1,47 @@ +------------------------------------------------------------------- +Wed Sep 9 11:24:12 UTC 2020 - Dirk Mueller + +- update to 2.24.0: + * see https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 + * Fix a vulnerability in the verification of X.509 certificates when matching + the expected common name (the cn argument of mbedtls_x509_crt_verify()) + with the actual certificate name: when the subjecAltName extension is + present, the expected name was compared to any name in that extension + regardless of its type. This means that an attacker could for example + impersonate a 4-bytes or 16-byte domain by getting a certificate for the + corresponding IPv4 or IPv6 (this would require the attacker to control that + IP address, though). Similar attacks using other subjectAltName name types + might be possible. + * When checking X.509 CRLs, a certificate was only considered as revoked if + its revocationDate was in the past according to the local clock if + available. In particular, on builds without MBEDTLS_HAVE_TIME_DATE, + certificates were never considered as revoked. On builds with + MBEDTLS_HAVE_TIME_DATE, an attacker able to control the local clock (for + example, an untrusted OS attacking a secure enclave) could prevent + revocation of certificates via CRLs. Fixed by no longer checking the + revocationDate field, in accordance with RFC 5280. Reported by yuemonangong + in #3340. Reported independently and fixed by Raoul Strackx and Jethro + * In (D)TLS record decryption, when using a CBC ciphersuites without the + Encrypt-then-Mac extension, use constant code flow memory access patterns + to extract and check the MAC. This is an improvement to the existing + countermeasure against Lucky 13 attacks. The previous countermeasure was + effective against network-based attackers, but less so against local + attackers. The new countermeasure defends against local attackers, even if + they have access to fine-grained measurements. In particular, this fixes a + local Lucky 13 cache attack found and reported by Tuba Yavuz, Farhaan + Fowze, Ken (Yihan) Bai, Grant Hernandez, and Kevin Butler (University of + Florida) and Dave Tian (Purdue University). + * Fix side channel in RSA private key operations and static (finite-field) + Diffie-Hellman. An adversary with precise enough timing and memory access + information (typically an untrusted operating system attacking a secure + enclave) could bypass an existing counter-measure (base blinding) and + potentially fully recover the private key. + * Fix a 1-byte buffer overread in mbedtls_x509_crl_parse_der(). Credit to + OSS-Fuzz for detecting the problem and to Philippe Antoine for pinpointing + the problematic code. + * Zeroising of plaintext buffers in mbedtls_ssl_read() to erase unused + application data from memory. + ------------------------------------------------------------------- Mon Sep 7 01:37:34 UTC 2020 - Stefan Brüns diff --git a/mbedtls.spec b/mbedtls.spec index f1a3623..7c0fd37 100644 --- a/mbedtls.spec +++ b/mbedtls.spec @@ -20,7 +20,7 @@ %define lib_crypto libmbedcrypto5 %define lib_x509 libmbedx509-1 Name: mbedtls -Version: 2.23.0 +Version: 2.24.0 Release: 0 Summary: Libraries for crypto and SSL/TLS protocols License: Apache-2.0 diff --git a/v2.23.0.tar.gz b/v2.23.0.tar.gz deleted file mode 100644 index 5b7f8da..0000000 --- a/v2.23.0.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:9933fe6b5991d5308e183a5a07454f76d7054721ba269d0c3811b227cb629e7a -size 3877270 diff --git a/v2.24.0.tar.gz b/v2.24.0.tar.gz new file mode 100644 index 0000000..4b550eb --- /dev/null +++ b/v2.24.0.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d436ae4892bd80329ca18a3960052fbb42d3f1f46c7519711d6763621ca6cfa0 +size 3911881