diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2017-05-29 11:59:34 +0200 |
|---|---|---|
| committer | Andreas Steffen <andreas.steffen@strongswan.org> | 2017-08-14 08:49:33 +0200 |
| commit | ef5c37fcdf47273feea320091598135688df4ef7 (patch) | |
| tree | a17fceab947c3779dd5378dcd5233f5508f0905c | |
| parent | d35183e33e149606119eb11ea7ce853bd0efd328 (diff) | |
| download | strongswan-ef5c37fcdf47273feea320091598135688df4ef7.tar.bz2 strongswan-ef5c37fcdf47273feea320091598135688df4ef7.tar.xz | |
gmp: Fix RSA signature verification for m >= n
By definition, m must be <= n-1, we didn't enforce that and because
mpz_export() returns NULL if the passed value is zero a crash could have
been triggered with m == n.
Fixes CVE-2017-11185.
| -rw-r--r-- | src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c index 32a72ac96..065c88903 100644 --- a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c +++ b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c @@ -78,11 +78,17 @@ static chunk_t rsaep(private_gmp_rsa_public_key_t *this, chunk_t data) mpz_t m, c; chunk_t encrypted; - mpz_init(c); mpz_init(m); - mpz_import(m, data.len, 1, 1, 1, 0, data.ptr); + if (mpz_cmp_ui(m, 0) <= 0 || mpz_cmp(m, this->n) >= 0) + { /* m must be <= n-1, and while 0 is technically a valid value, it + * doesn't really make sense here, so we filter that too */ + mpz_clear(m); + return chunk_empty; + } + + mpz_init(c); mpz_powm(c, m, this->e, this->n); encrypted.len = this->k; @@ -150,7 +156,7 @@ static bool verify_emsa_pkcs1_signature(private_gmp_rsa_public_key_t *this, */ /* check magic bytes */ - if (*(em.ptr) != 0x00 || *(em.ptr+1) != 0x01) + if (em.len < 2 || *(em.ptr) != 0x00 || *(em.ptr+1) != 0x01) { goto end; } |