root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Fix a key repointing in various ciphers 

In the dupctx fixups I missed a pointer that needed to be repointed to
the surrounding structures AES_KEY structure for the sm4/aes/aria
ccm/gcm variants.  This caused a colliding use of the key and possible
use after free issues.

Fixes #22076

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22102)
This commit is contained in:
Neil Horman 2023-09-12 17:09:06 -04:00 committed by Pauli
parent bbb6d620f6
commit 0ca5cf9891
5 changed files with 35 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
providers/implementations/ciphers/cipher_aes_gcm.c
View File

@ -37,10 +37,16 @@ static void *aes_gcm_newctx(void *provctx, size_t keybits)
static void *aes_gcm_dupctx(void *provctx)
{
PROV_AES_GCM_CTX *ctx = provctx;
PROV_AES_GCM_CTX *dctx = NULL;
if (ctx == NULL)
return NULL;
return OPENSSL_memdup(ctx, sizeof(*ctx));
dctx = OPENSSL_memdup(ctx, sizeof(*ctx));
if (dctx != NULL && dctx->base.gcm.key != NULL)
dctx->base.gcm.key = &dctx->ks.ks;
return dctx;
}
static OSSL_FUNC_cipher_freectx_fn aes_gcm_freectx;

8
providers/implementations/ciphers/cipher_aria_ccm.c
View File

@ -31,10 +31,16 @@ static void *aria_ccm_newctx(void *provctx, size_t keybits)
static void *aria_ccm_dupctx(void *provctx)
{
PROV_ARIA_CCM_CTX *ctx = provctx;
PROV_ARIA_CCM_CTX *dctx = NULL;
if (ctx == NULL)
return NULL;
return OPENSSL_memdup(ctx, sizeof(*ctx));
dctx = OPENSSL_memdup(ctx, sizeof(*ctx));
if (dctx != NULL && dctx->base.ccm_ctx.key != NULL)
dctx->base.ccm_ctx.key = &dctx->ks.ks;
return dctx;
}
static void aria_ccm_freectx(void *vctx)

8
providers/implementations/ciphers/cipher_aria_gcm.c
View File

@ -30,10 +30,16 @@ static void *aria_gcm_newctx(void *provctx, size_t keybits)
static void *aria_gcm_dupctx(void *provctx)
{
PROV_ARIA_GCM_CTX *ctx = provctx;
PROV_ARIA_GCM_CTX *dctx = NULL;
if (ctx == NULL)
return NULL;
return OPENSSL_memdup(ctx, sizeof(*ctx));
dctx = OPENSSL_memdup(ctx, sizeof(*ctx));
if (dctx != NULL && dctx->base.gcm.key != NULL)
dctx->base.gcm.key = &dctx->ks.ks;
return dctx;
}
static OSSL_FUNC_cipher_freectx_fn aria_gcm_freectx;

8
providers/implementations/ciphers/cipher_sm4_ccm.c
View File

@ -31,10 +31,16 @@ static void *sm4_ccm_newctx(void *provctx, size_t keybits)
static void *sm4_ccm_dupctx(void *provctx)
{
PROV_SM4_CCM_CTX *ctx = provctx;
PROV_SM4_CCM_CTX *dctx = NULL;
if (ctx == NULL)
return NULL;
return OPENSSL_memdup(ctx, sizeof(*ctx));
dctx = OPENSSL_memdup(ctx, sizeof(*ctx));
if (dctx != NULL && dctx->base.ccm_ctx.key != NULL)
dctx->base.ccm_ctx.key = &dctx->ks.ks;
return dctx;
}
static void sm4_ccm_freectx(void *vctx)

8
providers/implementations/ciphers/cipher_sm4_gcm.c
View File

@ -32,10 +32,16 @@ static void *sm4_gcm_newctx(void *provctx, size_t keybits)
static void *sm4_gcm_dupctx(void *provctx)
{
PROV_SM4_GCM_CTX *ctx = provctx;
PROV_SM4_GCM_CTX *dctx = NULL;
if (ctx == NULL)
return NULL;
return OPENSSL_memdup(ctx, sizeof(*ctx));
dctx = OPENSSL_memdup(ctx, sizeof(*ctx));
if (dctx != NULL && dctx->base.gcm.key != NULL)
dctx->base.gcm.key = &dctx->ks.ks;
return dctx;
}
static void sm4_gcm_freectx(void *vctx)