Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix possible integer overflow #546

Merged
merged 1 commit into from
Jun 1, 2023
Merged

Fix possible integer overflow #546

merged 1 commit into from
Jun 1, 2023

Conversation

czurnieden
Copy link
Contributor

It was possible to give mp_grow a negative size argument.
Several other functions got an extra check for negative input, too.

@czurnieden czurnieden added the bug label May 9, 2023
@czurnieden czurnieden requested a review from sjaeckel May 9, 2023 15:20
@czurnieden
Copy link
Contributor Author

@sjaeckel please ask the reporter of that bug if they want to remain anonymous. I would like to put their name in, otherwise.

@sjaeckel
Copy link
Member

@gal1ium thanks for reporting this. Do you wanna have a look at the changes?

@gal1ium
Copy link

gal1ium commented May 10, 2023

@gal1ium thanks for reporting this. Do you wanna have a look at the changes?

I think they're good! Thanks!

sjaeckel
sjaeckel approved these changes May 10, 2023
View reviewed changes
Copy link
Member

@sjaeckel sjaeckel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ty @czurnieden for going through the sources - I double checked and it looks good.

I also cherry-picked this to develop locally and will open a PR soon.

bn_mp_init_size.c
Comment on lines +9 to +13

if (size < 0) {
return MP_VAL;
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure whether this really makes sense here, since size is already sanitized right after ... OTOH it's an invalid usage ...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wasn't sure either, but it is an error and marking it as such is nice to the user—useful for debugging.

@czurnieden
Copy link
Contributor Author

I double checked and it looks good.

None forgotten? Good.

I also cherry-picked this to develop locally and will open a PR soon.

Ah, thanks, wasn't able to get to it till now.

@sjaeckel sjaeckel merged commit 7bbc1f8 into libtom:master Jun 1, 2023
@sjaeckel sjaeckel mentioned this pull request Jun 1, 2023
Merged
@sjaeckel
Copy link
Member

sjaeckel commented Jun 1, 2023

@dod38fr @scaronni @gahr @DimStar77 @dfandrich @antonio-rojas @Millak

could you please include this patch in your distro?

@gahr
Copy link

gahr commented Jun 1, 2023

@sjaeckel I can do that - are you planning a patch release, anyway?

@dfandrich
Copy link

Does this fix a security vulnerability? Glacing at the diff, it looks like it fixes some things that a buggy program might hit but affect parameters that would not generally be under the control of an attacker.

@dod38fr
Copy link

dod38fr commented Jun 3, 2023

@dod38fr @scaronni @gahr @DimStar77 @dfandrich @antonio-rojas @Millak

could you please include this patch in your distro?

It's too late for Debian 12 which is to be released next week.

I'll patch libtommath in Debian/unstable once Debian 12 is out. If this bug turns out to be a security issue, I'll make sure to include in a future Debian 12 point release (e.g. 12.1).

@gahr
Copy link

gahr commented Jun 28, 2023 •
edited
Loading

I patched the FreeBSD port: https://cgit.freebsd.org/ports/commit/?id=02c46239ac8dce1c3573803e6c95ae152aa61ee9

still eager to know if there's a release coming

@sjaeckel
Copy link
Member

I don't think there will be a patch release, but a new release will come which includes this patch.

@samueloph
Copy link

CVE-2023-36328 was assigned to this.

I had no involvement in the assignment, posting here for reference only.

@sjaeckel
Copy link
Member

sjaeckel commented Sep 4, 2023

Seems like someone really thinks that this needs a bugfix release ...

https://github.com/libtom/libtommath/releases/tag/v1.2.1

@sjaeckel sjaeckel mentioned this pull request Sep 5, 2023
Merged
kraj pushed a commit to YoeDistro/poky that referenced this pull request Sep 9, 2023
@yogi-u @kraj
dropbear: fix CVE-2023-36328
be6fefd 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: 538a88f858b860a1aa7aa90d9091fb98e67f3d54)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
halstead pushed a commit to yoctoproject/poky that referenced this pull request Sep 9, 2023
@yogi-u @rpurdie
dropbear: fix CVE-2023-36328
617ab3f 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: 9ee1f7a0fcbb6a8d5e8be3d602cf6c0e75fab34b)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Sep 9, 2023
@yogi-u @rpurdie
dropbear: fix CVE-2023-36328
9ee1f7a 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to yoctoproject/poky that referenced this pull request Sep 9, 2023
@yogi-u @rpurdie
dropbear: fix CVE-2023-36328
ea692b2 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: 09d1d126d755d15106ce40b3d74457f5a301cf3f)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Sep 9, 2023
@yogi-u @rpurdie
dropbear: fix CVE-2023-36328
09d1d12 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to yoctoproject/poky that referenced this pull request Sep 9, 2023
@yogi-u @rpurdie
dropbear: fix CVE-2023-36328
a09d8af 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: aa392840d625f5c45832e7ddf60c4dfaba3c4287)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Sep 9, 2023
@yogi-u @rpurdie
dropbear: fix CVE-2023-36328
aa39284 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Sep 18, 2023
@yogi-u @sakoman
dropbear: fix CVE-2023-36328
38709b0 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
halstead pushed a commit to yoctoproject/poky that referenced this pull request Sep 18, 2023
@yogi-u @sakoman
dropbear: fix CVE-2023-36328
fb8ca2c 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: 38709b0d35e7bd6760285bfa926dc85985c5cdcd)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Sep 20, 2023
@yogi-u @sakoman
dropbear: fix CVE-2023-36328
e2fe2c2 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
halstead pushed a commit to yoctoproject/poky that referenced this pull request Sep 20, 2023
@yogi-u @sakoman
dropbear: fix CVE-2023-36328
3117647 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: e2fe2c2066b066b1561eaba7bd7f27d4079c3cd6)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
jpuhlman pushed a commit to MontaVista-OpenSourceTechnology/poky that referenced this pull request Sep 25, 2023
@yogi-u @jpuhlman
dropbear: fix CVE-2023-36328
53665a4 
Source: poky
MR: 127628
Type: Integration
Disposition: Merged from poky
ChangeID: fb8ca2c
Description:

Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: 38709b0d35e7bd6760285bfa926dc85985c5cdcd)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
@Felixxz
Copy link

Felixxz commented Mar 3, 2024

I see an error in the description https://nvd.nist.gov/vuln/detail/CVE-2023-36328#range-9994440 of the versions affected by the vulnerability. Version 1.2.1 is included, although it contains changes from this commit:
beba892
Can you correct and remove version 1.2.1 from the nist.gov description?

@sjaeckel
Copy link
Member

sjaeckel commented Mar 4, 2024

I contacted them, let's see what happens and when :-)

@sjaeckel
Copy link
Member

sjaeckel commented Mar 6, 2024

Version is fixed, list will be updated within the next 24hours

@sjaeckel sjaeckel added this to the v2.0.0 milestone Mar 12, 2024
daregit pushed a commit to daregit/yocto-combined that referenced this pull request May 22, 2024
@yogi-u @rpurdie
src/poky:dropbear: fix CVE-2023-36328
6b66200 
Integer Overflow vulnerability in mp_grow in libtom libtommath before
commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to
execute arbitrary code and cause a denial of service (DoS).

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36328
libtom/libtommath#546

(From OE-Core rev: aa392840d625f5c45832e7ddf60c4dfaba3c4287)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sjaeckel sjaeckel sjaeckel approved these changes

Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
v2.0.0
Development

Successfully merging this pull request may close these issues.

None yet
9 participants
@czurnieden @sjaeckel @gal1ium @gahr @dfandrich @dod38fr @samueloph @Felixxz @kloczek