Skip to content

Commit

Permalink
Fix DH_check() excessive time with over sized modulus
Browse files Browse the repository at this point in the history
The DH_check() function checks numerous aspects of the key or parameters
that have been supplied. Some of those checks use the supplied modulus
value even if it is excessively large.

There is already a maximum DH modulus size (10,000 bits) over which
OpenSSL will not generate or derive keys. DH_check() will however still
perform various tests for validity on such a large modulus. We introduce a
new maximum (32,768) over which DH_check() will just fail.

An application that calls DH_check() and supplies a key or parameters
obtained from an untrusted source could be vulnerable to a Denial of
Service attack.

The function DH_check() is itself called by a number of other OpenSSL
functions. An application calling any of those other functions may
similarly be affected. The other functions affected by this are
DH_check_ex() and EVP_PKEY_param_check().

CVE-2023-3446

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from #21451)

(cherry picked from commit 9e0094e)
  • Loading branch information
mattcaswell authored and t8m committed Jul 19, 2023
1 parent 2c09df2 commit fc9867c
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 1 deletion.
6 changes: 6 additions & 0 deletions crypto/dh/dh_check.c
Expand Up @@ -152,6 +152,12 @@ int DH_check(const DH *dh, int *ret)
if (nid != NID_undef)
return 1;

/* Don't do any checks at all with an excessively large modulus */
if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE);
return 0;
}

if (!DH_check_params(dh, ret))
return 0;

Expand Down
6 changes: 5 additions & 1 deletion include/openssl/dh.h
Expand Up @@ -92,7 +92,11 @@ int EVP_PKEY_CTX_get0_dh_kdf_ukm(EVP_PKEY_CTX *ctx, unsigned char **ukm);
# include <openssl/dherr.h>

# ifndef OPENSSL_DH_MAX_MODULUS_BITS
# define OPENSSL_DH_MAX_MODULUS_BITS 10000
# define OPENSSL_DH_MAX_MODULUS_BITS 10000
# endif

# ifndef OPENSSL_DH_CHECK_MAX_MODULUS_BITS
# define OPENSSL_DH_CHECK_MAX_MODULUS_BITS 32768
# endif

# define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024
Expand Down

0 comments on commit fc9867c

Please sign in to comment.