Attachment 875303 Details for Bug 1225551

[patch] openssl-1_1-0001-Set-rl-packet-to-NULL-after-we-ve-finished-using-it.patch

openssl-1_1-0001-Set-rl-packet-to-NULL-after-we-ve-finished-using-it.patch (text/plain), 1.86 KB, created by Marcus Meissner on 2024-06-04 15:15:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2024-06-04 15:15:53 UTC

Size: 1.86 KB

patch

obsolete

>From bfb8128190632092b3a66465838b87b469455cec Mon Sep 17 00:00:00 2001
>From: Matt Caswell <matt@openssl.org>
>Date: Tue, 23 Apr 2024 16:36:11 +0100
>Subject: [PATCH] Set rl->packet to NULL after we've finished using it
>
>In order to ensure we do not have a UAF we reset the rl->packet pointer
>to NULL after we free it.
>
>Follow on from CVE-2024-4741
>
>Reviewed-by: Tomas Mraz <tomas@openssl.org>
>Reviewed-by: Neil Horman <nhorman@openssl.org>
>(Merged from https://github.com/openssl/openssl/pull/24395)
>---
> ssl/record/methods/tls_common.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>Index: openssl-1.1.1l/ssl/record/ssl3_buffer.c
>===================================================================
>--- openssl-1.1.1l.orig/ssl/record/ssl3_buffer.c
>+++ openssl-1.1.1l/ssl/record/ssl3_buffer.c
>@@ -174,5 +174,7 @@ int ssl3_release_read_buffer(SSL *s)
>     b = RECORD_LAYER_get_rbuf(&s->rlayer);
>     OPENSSL_free(b->buf);
>     b->buf = NULL;
>+    s->rlayer.packet = NULL;
>+    s->rlayer.packet_length = 0;
>     return 1;
> }
>Index: openssl-1.1.1l/ssl/record/rec_layer_s3.c
>===================================================================
>--- openssl-1.1.1l.orig/ssl/record/rec_layer_s3.c
>+++ openssl-1.1.1l/ssl/record/rec_layer_s3.c
>@@ -16,6 +16,7 @@
> #include <openssl/rand.h>
> #include "record_local.h"
> #include "../packet_local.h"
>+#include "internal/cryptlib.h"
> 
> #if     defined(OPENSSL_SMALL_FOOTPRINT) || \
>         !(      defined(AESNI_ASM) &&   ( \
>@@ -225,6 +226,12 @@ int ssl3_read_n(SSL *s, size_t n, size_t
>         s->rlayer.packet_length = 0;
>         /* ... now we can act as if 'extend' was set */
>     }
>+    if (!ossl_assert(s->rlayer.packet != NULL)) {
>+        /* does not happen */
>+        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL3_READ_N,
>+                 ERR_R_INTERNAL_ERROR);
>+        return -1;
>+    }
> 
>     len = s->rlayer.packet_length;
>     pkt = rb->buf + align;

Actions: View | Diff

Attachments on bug 1225551: 875302 | 875303