Date: Sat, 20 Aug 2016 14:06:42 +0000 From: Pascal Cuoq <cuoq@...st-in-soft.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> CC: "wk@...pg.org" <wk@...pg.org>, Raphaël Rieu-Helft <raphael.rieu-helft@...st-in-soft.com> Subject: memory issues in libksba 1.3.4 and git Hello all, this GitHub commit illustrates a memory issue present in in libksba 1.3.4 and in the current git tree from git://git.gnupg.org/libksba.git : https://github.com/pascal-cuoq/libksba-fork/commit/709642767fbf7f2030d89bca4e4b192d612400ae In summary: Executing “tests/cert-basic long_time.crt” allocates a disproportionate 33MB of memory. In the current libksba git snapshot, this memory is initialized to zero, which takes a couple of milliseconds (probably mostly spent handling pagefaults), which is more than it should take to parse a certificate of a few hundred bytes on a modern computer. In version 1.3.4, the memory is left uninitialized, so no time is wasted. The commit that causes the memory to be initialized is https://github.com/pascal-cuoq/libksba-fork/commit/2a9fc5654df497b91ab9b64e946c1e19371888e5 and this commit was applied to prevent uninitialized memory from being incorporated into computations. Executing “tests/cert-basic 90s.crt” allocates 60146387817 bytes (60GB). In the current libksba git snapshot, initializing this memory takes several seconds. Executing “tests/cert-basic 0.0.0.0.0.crt” allocates 3MB of memory, which are either left uninitialized (1.3.4 version) or initialized to zero (git version). A large part of this memory is then converted to an “AuthorityKeyIdentifier”. In the git version, this produces a long sequence of 0.0.0.0... In version 1.3.4, since it's uninitialized memory that is used, the sequence may look different, and may contain secrets. “Secrets” here include cryptographic secrets that would unhygienically have been left in a freed memory block, but also addresses of variables, of library functions, etc. that might make another vulnerability exploitable. These inputs have been set to Werner Koch, privately as per his request, on May 25, June 11 and July 11. I am publishing them now so that anyone who uses or might want to use libksba to parse messages (received pre-authentification by definition) can make an informed choice considering the risks of denial of service and information leak. The inputs were found and kindly placed in the “hangs” result directory by afl-fuzz. The undefined behaviors caused by the inputs were investigated with tis-interpreter and a dependency analysis prototype developed by Raphaël Rieu-Helft. The results shown in https://github.com/pascal-cuoq/libksba-fork/blob/master/log were obtained by running ./autogen.sh, ./configure and make to build an instrumented version of libksba on a 128GiB Linux workstation (Ubuntu 16.04). Pascal
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ