Pedro Monreal Gonzalez
2f6ae03793
- Security fix: [bsc#1213487, CVE-2023-3446]
* Fix DH_check() excessive time with over sized modulus.
* The function DH_check() performs various checks on DH parameters.
One of those checks confirms that the modulus ("p" parameter) is
not too large. Trying to use a very large modulus is slow and
OpenSSL will not normally use a modulus which is over 10,000 bits
in length.
However the DH_check() function checks numerous aspects of the
key or parameters that have been supplied. Some of those checks
use the supplied modulus value even if it has already been found
to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying
a key/parameters with a modulus over this size will simply cause
DH_check() to fail.
* Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch
OBS-URL: https://build.opensuse.org/request/show/1099668
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=139
59 lines
2.0 KiB
Diff
59 lines
2.0 KiB
Diff
From e9ddae17e302a7e6a0daf00f25efed7c70f114d4 Mon Sep 17 00:00:00 2001
|
|
From: Matt Caswell <matt@openssl.org>
|
|
Date: Fri, 7 Jul 2023 14:39:48 +0100
|
|
Subject: [PATCH] Add a test for CVE-2023-3446
|
|
|
|
Confirm that the only errors DH_check() finds with DH parameters with an
|
|
excessively long modulus is that the modulus is too large. We should not
|
|
be performing time consuming checks using that modulus.
|
|
|
|
Reviewed-by: Paul Dale <pauli@openssl.org>
|
|
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
|
|
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
|
|
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
|
(Merged from https://github.com/openssl/openssl/pull/21452)
|
|
---
|
|
test/dhtest.c | 15 +++++++++++++--
|
|
1 file changed, 13 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/test/dhtest.c b/test/dhtest.c
|
|
index 9d5609b943ab..00b3c471015d 100644
|
|
--- a/test/dhtest.c
|
|
+++ b/test/dhtest.c
|
|
@@ -63,7 +63,7 @@ static int dh_test(void)
|
|
|| !TEST_true(DH_set0_pqg(dh, p, q, g)))
|
|
goto err1;
|
|
|
|
- if (!DH_check(dh, &i))
|
|
+ if (!TEST_true(DH_check(dh, &i)))
|
|
goto err2;
|
|
if (!TEST_false(i & DH_CHECK_P_NOT_PRIME)
|
|
|| !TEST_false(i & DH_CHECK_P_NOT_SAFE_PRIME)
|
|
@@ -123,6 +123,17 @@ static int dh_test(void)
|
|
/* check whether the public key was calculated correctly */
|
|
TEST_uint_eq(BN_get_word(pub_key2), 3331L);
|
|
|
|
+ /* Modulus of size: dh check max modulus bits + 1 */
|
|
+ if (!TEST_true(BN_set_word(p, 1))
|
|
+ || !TEST_true(BN_lshift(p, p, OPENSSL_DH_CHECK_MAX_MODULUS_BITS)))
|
|
+ goto err3;
|
|
+
|
|
+ /*
|
|
+ * We expect no checks at all for an excessively large modulus
|
|
+ */
|
|
+ if (!TEST_false(DH_check(dh, &i)))
|
|
+ goto err3;
|
|
+
|
|
/*
|
|
* II) key generation
|
|
*/
|
|
@@ -137,7 +148,7 @@ static int dh_test(void)
|
|
goto err3;
|
|
|
|
/* ... and check whether it is valid */
|
|
- if (!DH_check(a, &i))
|
|
+ if (!TEST_true(DH_check(a, &i)))
|
|
goto err3;
|
|
if (!TEST_false(i & DH_CHECK_P_NOT_PRIME)
|
|
|| !TEST_false(i & DH_CHECK_P_NOT_SAFE_PRIME)
|