Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add check of result chmod() in RAND_file_name(...) #25143

Open
nv-dmd opened this issue Aug 8, 2024 · 1 comment
Open

Add check of result chmod() in RAND_file_name(...) #25143

nv-dmd opened this issue Aug 8, 2024 · 1 comment
Assignees
Labels
help wanted triaged: bug The issue/pr is/fixes a bug

Comments

@nv-dmd
Copy link

nv-dmd commented Aug 8, 2024

OpenSSL 3.0.14

In the function RAND_file_name(), chmod(file, 0600) is executed on line 249.
But the result of the chmod(...) function execution is not checked.
Maybe it is worth checking the result, because chmod(...) should restrict permissions and its successful execution seems important?

@nv-dmd nv-dmd added the issue: bug report The issue was opened to report a bug label Aug 8, 2024
@paulidale paulidale added triaged: bug The issue/pr is/fixes a bug and removed issue: bug report The issue was opened to report a bug labels Aug 8, 2024
@paulidale
Copy link
Contributor

paulidale commented Aug 8, 2024

Yes, it is import but only if you are running VMS. On Unix like systems, the file is created with mode 0600 on line 210 making this redundant.

This chmod should be conditioned as VMS only and the return value should be checked.
It's also a race condition waiting to happen.

Fortunately, OpenSSL doesn't attribute any entropy to rand-files, so this isn't going to compromise the RAND subsystem.

@t8m t8m added the help wanted label Sep 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted triaged: bug The issue/pr is/fixes a bug
Projects
None yet
Development

No branches or pull requests

4 participants