Codebase list openssl / 631f94d
Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey An attack is simple, if the first CMS_recipientInfo is valid but the second CMS_recipientInfo is chosen ciphertext. If the second recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct encryption key will be replaced by garbage, and the message cannot be decoded, but if the RSA decryption fails, the correct encryption key is used and the recipient will not notice the attack. As a work around for this potential attack the length of the decrypted key must be equal to the cipher default key length, in case the certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9777) (cherry picked from commit 5840ed0cd1e6487d247efbc1a04136a41d7b3a37) Bernd Edlinger authored 4 years ago Matt Caswell committed 4 years ago
5 changed file(s) with 45 addition(s) and 5 deletion(s). Raw diff Collapse all Expand all
+14
-0
CHANGES less more
3737 does some minimal sanity checks on the passed order.
3838 (CVE-2019-1547)
3939 [Billy Bob Brumley]
40
41 *) Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.
42 An attack is simple, if the first CMS_recipientInfo is valid but the
43 second CMS_recipientInfo is chosen ciphertext. If the second
44 recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct
45 encryption key will be replaced by garbage, and the message cannot be
46 decoded, but if the RSA decryption fails, the correct encryption key is
47 used and the recipient will not notice the attack.
48 As a work around for this potential attack the length of the decrypted
49 key must be equal to the cipher default key length, in case the
50 certifiate is not given and all recipientInfo are tried out.
51 The old behaviour can be re-enabled in the CMS code by setting the
52 CMS_DEBUG_DECRYPT flag.
53 [Bernd Edlinger]
4054
4155 *) Use Windows installation paths in the mingw builds
4256
+17
-1
crypto/cms/cms_env.c less more
362362 unsigned char *ek = NULL;
363363 size_t eklen;
364364 int ret = 0;
365 size_t fixlen = 0;
365366 CMS_EncryptedContentInfo *ec;
366367 ec = cms->d.envelopedData->encryptedContentInfo;
367368
368369 if (ktri->pkey == NULL) {
369370 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT, CMS_R_NO_PRIVATE_KEY);
370371 return 0;
372 }
373
374 if (cms->d.envelopedData->encryptedContentInfo->havenocert
375 && !cms->d.envelopedData->encryptedContentInfo->debug) {
376 X509_ALGOR *calg = ec->contentEncryptionAlgorithm;
377 const EVP_CIPHER *ciph = EVP_get_cipherbyobj(calg->algorithm);
378
379 if (ciph == NULL) {
380 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT, CMS_R_UNKNOWN_CIPHER);
381 return 0;
382 }
383
384 fixlen = EVP_CIPHER_key_length(ciph);
371385 }
372386
373387 ktri->pctx = EVP_PKEY_CTX_new(pkey, NULL);
400414
401415 if (EVP_PKEY_decrypt(ktri->pctx, ek, &eklen,
402416 ktri->encryptedKey->data,
403 ktri->encryptedKey->length) <= 0) {
417 ktri->encryptedKey->length) <= 0
418 || eklen == 0
419 || (fixlen != 0 && eklen != fixlen)) {
404420 CMSerr(CMS_F_CMS_RECIPIENTINFO_KTRI_DECRYPT, CMS_R_CMS_LIB);
405421 goto err;
406422 }
+2
-0
crypto/cms/cms_lcl.h less more
128128 size_t keylen;
129129 /* Set to 1 if we are debugging decrypt and don't fake keys for MMA */
130130 int debug;
131 /* Set to 1 if we have no cert and need extra safety measures for MMA */
132 int havenocert;
131133 };
132134
133135 struct CMS_RecipientInfo_st {
+4
-0
crypto/cms/cms_smime.c less more
742742 cms->d.envelopedData->encryptedContentInfo->debug = 1;
743743 else
744744 cms->d.envelopedData->encryptedContentInfo->debug = 0;
745 if (!cert)
746 cms->d.envelopedData->encryptedContentInfo->havenocert = 1;
747 else
748 cms->d.envelopedData->encryptedContentInfo->havenocert = 0;
745749 if (!pk && !cert && !dcont && !out)
746750 return 1;
747751 if (pk && !CMS_decrypt_set1_pkey(cms, pk, cert))
+8
-4
crypto/pkcs7/pk7_doit.c less more
136136 }
137137
138138 static int pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen,
139 PKCS7_RECIP_INFO *ri, EVP_PKEY *pkey)
139 PKCS7_RECIP_INFO *ri, EVP_PKEY *pkey,
140 size_t fixlen)
140141 {
141142 EVP_PKEY_CTX *pctx = NULL;
142143 unsigned char *ek = NULL;
169170 }
170171
171172 if (EVP_PKEY_decrypt(pctx, ek, &eklen,
172 ri->enc_key->data, ri->enc_key->length) <= 0) {
173 ri->enc_key->data, ri->enc_key->length) <= 0
174 || eklen == 0
175 || (fixlen != 0 && eklen != fixlen)) {
173176 ret = 0;
174177 PKCS7err(PKCS7_F_PKCS7_DECRYPT_RINFO, ERR_R_EVP_LIB);
175178 goto err;
498501 for (i = 0; i < sk_PKCS7_RECIP_INFO_num(rsk); i++) {
499502 ri = sk_PKCS7_RECIP_INFO_value(rsk, i);
500503
501 if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) < 0)
504 if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey,
505 EVP_CIPHER_key_length(evp_cipher)) < 0)
502506 goto err;
503507 ERR_clear_error();
504508 }
505509 } else {
506510 /* Only exit on fatal errors, not decrypt failure */
507 if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey) < 0)
511 if (pkcs7_decrypt_rinfo(&ek, &eklen, ri, pkey, 0) < 0)
508512 goto err;
509513 ERR_clear_error();
510514 }