From 4b390b6c3f8df925dc92a3dd6b022baa9a2f4650 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 19 Sep 2016 11:39:21 +0100 Subject: [PATCH] Excessive allocation of memory in tls_get_message_header() A TLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated in OpenSSL this could mean an attacker could force up to 21Mb to be allocated to service a connection. This could lead to a Denial of Service through memory exhaustion. However, the excessive message length check still takes place, and this would cause the connection to immediately fail. Assuming that the application calls SSL_free() on the failed conneciton in a timely manner then the 21Mb of allocated memory will then be immediately freed again. Therefore the excessive memory allocation will be transitory in nature. This then means that there is only a security impact if: 1) The application does not call SSL_free() in a timely manner in the event that the connection fails or 2) The application is working in a constrained environment where there is very little free memory or 3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL_free() has not yet been called; and there is insufficient memory to service the multiple requests. Except in the instance of (1) above any Denial Of Service is likely to be transitory because as soon as the connection fails the memory is subsequently freed again in the SSL_free() call. However there is an increased risk during this period of application crashes due to the lack of memory - which would then mean a more serious Denial of Service. This issue does not affect DTLS users. Issue was reported by Shi Lei (Gear Team, Qihoo 360 Inc.). CVE-2016-6307 Reviewed-by: Richard Levitte (cherry picked from commit c1ef7c971d0bbf117c3c80f65b5875e2e7b024b1) --- ssl/statem/statem.c | 11 +++++++++++ ssl/statem/statem_lib.c | 10 ---------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/ssl/statem/statem.c b/ssl/statem/statem.c index df3008575d196..8bc1febd10742 100644 --- a/ssl/statem/statem.c +++ b/ssl/statem/statem.c @@ -542,6 +542,17 @@ static SUB_STATE_RETURN read_state_machine(SSL *s) return SUB_STATE_ERROR; } + /* dtls_get_message already did this */ + if (!SSL_IS_DTLS(s) + && s->s3->tmp.message_size > 0 + && !BUF_MEM_grow_clean(s->init_buf, + (int)s->s3->tmp.message_size + + SSL3_HM_HEADER_LENGTH)) { + ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); + SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, ERR_R_BUF_LIB); + return SUB_STATE_ERROR; + } + st->read_state = READ_STATE_BODY; /* Fall through */ diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index 19b75a7ac70f9..31a84e4428256 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -414,10 +414,6 @@ int tls_get_message_header(SSL *s, int *mt) */ l = RECORD_LAYER_get_rrec_length(&s->rlayer) + SSL3_HM_HEADER_LENGTH; - if (l && !BUF_MEM_grow_clean(s->init_buf, (int)l)) { - SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, ERR_R_BUF_LIB); - goto err; - } s->s3->tmp.message_size = l; s->init_msg = s->init_buf->data; @@ -430,11 +426,6 @@ int tls_get_message_header(SSL *s, int *mt) SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, SSL_R_EXCESSIVE_MESSAGE_SIZE); goto f_err; } - if (l && !BUF_MEM_grow_clean(s->init_buf, - (int)l + SSL3_HM_HEADER_LENGTH)) { - SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, ERR_R_BUF_LIB); - goto err; - } s->s3->tmp.message_size = l; s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH; @@ -444,7 +435,6 @@ int tls_get_message_header(SSL *s, int *mt) return 1; f_err: ssl3_send_alert(s, SSL3_AL_FATAL, al); - err: return 0; }