Projects
openEuler:20.03:LTS:SP3
edk2
_service:tar_scm_kernel_repo:0053-DH_check-Do-n...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm_kernel_repo:0053-DH_check-Do-not-try-checking-q-properties-if-it-is-o.patch of Package edk2
From fd48ea56b63f33f012f72340eb4e3f9de163ae4e Mon Sep 17 00:00:00 2001 From: Tomas Mraz <tomas@openssl.org> Date: Fri, 21 Jul 2023 11:39:41 +0200 Subject: [PATCH 09/11] DH_check(): Do not try checking q properties if it is obviously invalid If |q| >= |p| then the q value is obviously wrong as q is supposed to be a prime divisor of p-1. We check if p is overly large so this added test implies that q is not large either when performing subsequent tests using that q value. Otherwise if it is too large these additional checks of the q value such as the primality test can then trigger DoS by doing overly long computations. Fixes CVE-2023-3817 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> reference: https://github.com/openssl/openssl/pull/21551 Signed-off-by: yexiao <yexiao7@huawei.com> --- .../Library/OpensslLib/openssl/crypto/dh/dh_check.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/dh/dh_check.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/dh/dh_check.c index e5f9dd50..28543412 100644 --- a/CryptoPkg/Library/OpensslLib/openssl/crypto/dh/dh_check.c +++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/dh/dh_check.c @@ -97,7 +97,7 @@ int DH_check_ex(const DH *dh) int DH_check(const DH *dh, int *ret) { - int ok = 0, r; + int ok = 0, r, q_good = 0; BN_CTX *ctx = NULL; BIGNUM *t1 = NULL, *t2 = NULL; @@ -119,7 +119,14 @@ int DH_check(const DH *dh, int *ret) if (t2 == NULL) goto err; - if (dh->q) { + if (dh->q != NULL) { + if (BN_ucmp(dh->p, dh->q) > 0) + q_good = 1; + else + *ret |= DH_CHECK_INVALID_Q_VALUE; + } + + if (q_good) { if (BN_cmp(dh->g, BN_value_one()) <= 0) *ret |= DH_NOT_SUITABLE_GENERATOR; else if (BN_cmp(dh->g, dh->p) >= 0) -- 2.33.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.