CVE-2018-0739: OpenSSL ASN.1 stack overflow

[Nytro]

CVE-2018-0739: OpenSSL ASN.1 stack overflow

This was a vulnerability discovered by Google’s OSS-Fuzz project and it was fixed by Matt Caswell of the OpenSSL development team. The vulnerability affects OpenSSL releases prior to 1.0.2o and 1.1.0h and based on OpenSSL team’s assessment, this cannot be triggered via SSL/TLS but constructed ASN.1 types with support for recursive definitions, such as PKCS7 can be used to trigger it.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

/*  * Decode an item, taking care of IMPLICIT tagging, if any. If 'opt' set and  * tag mismatch return -1 to handle OPTIONAL  */   static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,                                long len, const ASN1_ITEM *it,                                int tag, int aclass, char opt, ASN1_TLC *ctx) {     const ASN1_TEMPLATE *tt, *errtt = NULL;     const ASN1_EXTERN_FUNCS *ef;     const ASN1_AUX *aux = it->funcs;     ASN1_aux_cb *asn1_cb;     const unsigned char *p = NULL, *q;     unsigned char oclass;     char seq_eoc, seq_nolen, cst, isopt;     long tmplen;     int i;     int otag;     int ret = 0;     ASN1_VALUE **pchptr;     if (!pval)         return 0;     if (aux && aux->asn1_cb)         asn1_cb = aux->asn1_cb;     else         asn1_cb = 0;       switch (it->itype) {    ...     return 0; }

What you see above is a snippet of crypto/asn1/tasn_dec.c where the decoding ASN.1 function asn1_item_embed_d2i() is located. Neither this function nor any of its callers had any check for recursive definitions. This means that given a malicious PKCS7 file this decoding routine will keep on trying to decode them until the process will run out of stack space.

To fix this, a new error case was added in crypto/asn1/asn1.h header file named ASN1_R_NESTED_TOO_DEEP. If we have a look at crypto/asn1/asn1_err.c we can see that the new error code is equivalent to the “nested too deep” error message.

1 2 3

{ERR_REASON(ASN1_R_NESTED_ASN1_STRING), "nested asn1 string"}, +    {ERR_REASON(ASN1_R_NESTED_TOO_DEEP), "nested too deep"},      {ERR_REASON(ASN1_R_NON_HEX_CHARACTERS), "non hex characters"},

Similarly, a new constant (ASN1_MAX_CONSTRUCTED_NEST) definition was added which is used to define the maximum amount of recursive invocations of asn1_item_embed_d2i() function. You can see the new definition in crypto/asn1/tasn_dec.c.

1 2 3 4 5 6 7 8 9 10 11

#include <openssl/err.h>   /*  * Constructed types with a recursive definition (such as can be found in PKCS7)  * could eventually exceed the stack given malicious input with excessive  * recursion. Therefore we limit the stack depth. This is the maximum number of  * recursive invocations of asn1_item_embed_d2i().  */ #define ASN1_MAX_CONSTRUCTED_NEST 30    static int asn1_check_eoc(const unsigned char **in, long len);

Lastly, the asn1_item_embed_d2i() function itself was modified to have a new integer argument “depth” which is used as a counter for each iteration. You can see how check is performed before entering the switch clause here.

1 2 3 4 5 6 7 8 9

asn1_cb = 0;   if (++depth > ASN1_MAX_CONSTRUCTED_NEST) {     ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NESTED_TOO_DEEP);     goto err; }   switch (it->itype) { case ASN1_ITYPE_PRIMITIVE:

Similarly, all calling functions on OpenSSL have been updated to ensure that the new argument is used as intended. The official security advisory describes the above vulnerability like this.

Constructed ASN.1 types with a recursive definition could exceed the stack (CVE-2018-0739)
==========================================================================================

Severity: Moderate

Constructed ASN.1 types with a recursive definition (such as can be found in
PKCS7) could eventually exceed the stack given malicious input with
excessive recursion. This could result in a Denial Of Service attack. There are
no such structures used within SSL/TLS that come from untrusted sources so this
is considered safe.

OpenSSL 1.1.0 users should upgrade to 1.1.0h
OpenSSL 1.0.2 users should upgrade to 1.0.2o
 
This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz project.
The fix was developed by Matt Caswell of the OpenSSL development team.

 

Sursa: https://xorl.wordpress.com/2018/03/30/cve-2018-0739-openssl-asn-1-stack-overflow/