[oe-commits] [openembedded-core] 07/15: openssl: Security fix CVE-2016-6306

[git at git.openembedded.org]

rpurdie pushed a commit to branch jethro
in repository openembedded-core.

commit 7277061de39cdcdc2d1db15cefd9040a54527cd6
Author: Armin Kuster <akuster at mvista.com>
AuthorDate: Fri Sep 23 23:18:57 2016 -0700

    openssl: Security fix CVE-2016-6306
    
    affects openssl < 1.0.1i
    
    Signed-off-by: Armin Kuster <akuster at mvista.com>
---
 .../openssl/openssl/CVE-2016-6306.patch            | 71 ++++++++++++++++++++++
 .../recipes-connectivity/openssl/openssl_1.0.2h.bb |  1 +
 2 files changed, 72 insertions(+)

diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch
new file mode 100644
index 0000000..9e7d576
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/CVE-2016-6306.patch
@@ -0,0 +1,71 @@
+From ff553f837172ecb2b5c8eca257ec3c5619a4b299 Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve at openssl.org>
+Date: Sat, 17 Sep 2016 12:36:58 +0100
+Subject: [PATCH] Fix small OOB reads.
+
+In ssl3_get_client_certificate, ssl3_get_server_certificate and
+ssl3_get_certificate_request check we have enough room
+before reading a length.
+
+Thanks to Shi Lei (Gear Team, Qihoo 360 Inc.) for reporting these bugs.
+
+CVE-2016-6306
+
+Reviewed-by: Richard Levitte <levitte at openssl.org>
+Reviewed-by: Matt Caswell <matt at openssl.org>
+
+Upstream-Status: Backport
+CVE: CVE-2016-6306
+Signed-off-by: Armin Kuster <akuster at mvista.com>
+
+---
+ ssl/s3_clnt.c | 11 +++++++++++
+ ssl/s3_srvr.c |  6 ++++++
+ 2 files changed, 17 insertions(+)
+
+Index: openssl-1.0.2h/ssl/s3_clnt.c
+===================================================================
+--- openssl-1.0.2h.orig/ssl/s3_clnt.c
++++ openssl-1.0.2h/ssl/s3_clnt.c
+@@ -1216,6 +1216,12 @@ int ssl3_get_server_certificate(SSL *s)
+         goto f_err;
+     }
+     for (nc = 0; nc < llen;) {
++        if (nc + 3 > llen) {
++            al = SSL_AD_DECODE_ERROR;
++            SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,
++                   SSL_R_CERT_LENGTH_MISMATCH);
++            goto f_err;
++        }
+         n2l3(p, l);
+         if ((l + nc + 3) > llen) {
+             al = SSL_AD_DECODE_ERROR;
+@@ -2167,6 +2173,11 @@ int ssl3_get_certificate_request(SSL *s)
+     }
+ 
+     for (nc = 0; nc < llen;) {
++        if (nc + 2 > llen) {
++            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
++            SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, SSL_R_CA_DN_TOO_LONG);
++            goto err;
++        }
+         n2s(p, l);
+         if ((l + nc + 2) > llen) {
+             if ((s->options & SSL_OP_NETSCAPE_CA_DN_BUG))
+Index: openssl-1.0.2h/ssl/s3_srvr.c
+===================================================================
+--- openssl-1.0.2h.orig/ssl/s3_srvr.c
++++ openssl-1.0.2h/ssl/s3_srvr.c
+@@ -3213,6 +3213,12 @@ int ssl3_get_client_certificate(SSL *s)
+         goto f_err;
+     }
+     for (nc = 0; nc < llen;) {
++        if (nc + 3 > llen) {
++            al = SSL_AD_DECODE_ERROR;
++            SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,
++                   SSL_R_CERT_LENGTH_MISMATCH);
++            goto f_err;
++        }
+         n2l3(p, l);
+         if ((l + nc + 3) > llen) {
+             al = SSL_AD_DECODE_ERROR;
diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb b/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
index 1fe0cb2..2aea8d9 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
@@ -48,6 +48,7 @@ SRC_URI += "file://configure-targets.patch \
             file://CVE-2016-6302.patch \
             file://CVE-2016-6303.patch \
             file://CVE-2016-6304.patch \
+            file://CVE-2016-6306.patch \
            "
 
 SRC_URI[md5sum] = "9392e65072ce4b614c1392eefc1f23d0"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.