Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120424142638.GF18917@cmpxchg8b.com>
Date: Tue, 24 Apr 2012 16:26:38 +0200
From: Tavis Ormandy <taviso@...xchg8b.com>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: OpenSSL ASN1 BIO vulnerability (CVE-2012-2110)

On Sun, Apr 22, 2012 at 07:44:56PM +0400, Solar Designer wrote:
> With this one, I am able to trigger a problem on 32-bit (OpenSSL 1.0.0d
> with unrelated patches):
> 
> $ zcat openssl-1.0.1-testcase-32bit.crt.gz | openssl x509 -inform DER
> *** glibc detected *** free(): invalid pointer: 0x45ff0008 ***
> Aborted
> 
> That's in an OpenVZ container with privvmpages barrier at 3 GB.
> With 2 GB, I was getting:
> 
> $ zcat openssl-1.0.1-testcase-32bit.crt.gz | openssl x509 -inform DER
> unable to load certificate
> 3083651232:error:07069041:memory buffer routines:BUF_MEM_grow_clean:malloc failure:buffer.c:152:
> 3083651232:error:0D06B041:asn1 encoding routines:ASN1_D2I_READ_BIO:malloc failure:a_d2i_fp.c:229:
> 
> Alexander

Interesting, I think it should be possible to construct a testcase that
requires less memory, the total input must be quite large, but it can
be split into smaller components that don't require large allocations.

Tavis.

-- 
-------------------------------------
taviso@...xchg8b.com | pgp encrypted mail preferred
-------------------------------------------------------

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.