openssl
/
openssl
mirror of https://github.com/openssl/openssl
1
0
Fork 0
Code Issues Releases Wiki Activity

Restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt will translate 

OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical
numeric text form.  For gigantic sub-identifiers, this would take a very
long time, the time complexity being O(n^2) where n is the size of that
sub-identifier.

To mitigate this, a restriction on the size that OBJ_obj2txt() will
translate to canonical numeric text form is added, based on RFC 2578
(STD 58), which says this:

> 3.5. OBJECT IDENTIFIER values
>
> An OBJECT IDENTIFIER value is an ordered list of non-negative numbers.
> For the SMIv2, each number in the list is referred to as a sub-identifier,
> there are at most 128 sub-identifiers in a value, and each sub-identifier
> has a maximum value of 2^32-1 (4294967295 decimal).

Fixes otc/security#96
Fixes CVE-2023-2650

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
This commit is contained in:
Richard Levitte 2023-05-12 10:00:13 +02:00 committed by Tomas Mraz
parent 3ca28c9e81
commit d63b3e7959
3 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
CHANGES.md
View File

@ -284,6 +284,32 @@ OpenSSL 3.1
### Changes between 3.1.0 and 3.1.1 [xx XXX xxxx]
* Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic
OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical
numeric text form. For gigantic sub-identifiers, this would take a very
long time, the time complexity being O(n^2) where n is the size of that
sub-identifier. ([CVE-2023-2650])
To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT
IDENTIFIER to canonical numeric text form if the size of that OBJECT
IDENTIFIER is 586 bytes or less, and fail otherwise.
The basis for this restriction is RFC 2578 (STD 58), section 3.5. OBJECT
IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at
most 128 sub-identifiers, and that the maximum value that each sub-
identifier may have is 2^32-1 (4294967295 decimal).
For each byte of every sub-identifier, only the 7 lower bits are part of
the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with
these restrictions may occupy is 32 * 128 / 7, which is approximately 586
bytes.
Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
*Richard Levitte*
* Multiple algorithm implementation fixes for ARM BE platforms.
*Liu-ErMeng*
@ -19976,6 +20002,7 @@ ndif
<!-- Links -->
[CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650
[CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255
[CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466
[CVE-2023-0465]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0465

4
NEWS.md
View File

@ -38,6 +38,8 @@ OpenSSL 3.1
### Major changes between OpenSSL 3.1.0 and OpenSSL 3.1.1 [under development]
* Mitigate for very slow `OBJ_obj2txt()` performance with gigantic OBJECT
IDENTIFIER sub-identities. ([CVE-2023-2650])
* Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms
([CVE-2023-1255])
* Fixed documentation of X509_VERIFY_PARAM_add0_policy() ([CVE-2023-0466])
@ -1468,6 +1470,8 @@ OpenSSL 0.9.x
* Support for various new platforms
<!-- Links -->
[CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650
[CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255
[CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466
[CVE-2023-0465]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0465

19
crypto/objects/obj_dat.c
View File

@ -464,6 +464,25 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
first = 1;
bl = NULL;
/*
* RFC 2578 (STD 58) says this about OBJECT IDENTIFIERs:
*
* > 3.5. OBJECT IDENTIFIER values
* >
* > An OBJECT IDENTIFIER value is an ordered list of non-negative
* > numbers. For the SMIv2, each number in the list is referred to as a
* > sub-identifier, there are at most 128 sub-identifiers in a value,
* > and each sub-identifier has a maximum value of 2^32-1 (4294967295
* > decimal).
*
* So a legitimate OID according to this RFC is at most (32 * 128 / 7),
* i.e. 586 bytes long.
*
* Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
*/
if (len > 586)
goto err;
while (len > 0) {
l = 0;
use_bn = 0;