From eb53f36c27dbc47c3c31425029554993b8e30550 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Wed, 18 Jan 2023 09:27:53 +0100 Subject: [PATCH] pk7_doit.c: Check return of BIO_set_md() calls These calls invoke EVP_DigestInit() which can fail for digests with implicit fetches. Subsequent EVP_DigestUpdate() from BIO_write() or EVP_DigestFinal() from BIO_read() will segfault on NULL dereference. This can be triggered by an attacker providing PKCS7 data digested with MD4 for example if the legacy provider is not loaded. If BIO_set_md() fails the md BIO cannot be used. CVE-2023-0401 Reviewed-by: Paul Dale Reviewed-by: Dmitry Belyavskiy Signed-off-by: code4lala Change-Id: Id19000b7a7fc2dbe28e9d41fb66d496ec7ca9ef1 --- crypto/pkcs7/pk7_doit.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c index f116e46411..dc149e9ead 100644 --- a/crypto/pkcs7/pk7_doit.c +++ b/crypto/pkcs7/pk7_doit.c @@ -84,7 +84,11 @@ static int pkcs7_bio_add_digest(BIO **pbio, X509_ALGOR *alg, } (void)ERR_pop_to_mark(); - BIO_set_md(btmp, md); + if (BIO_set_md(btmp, md) <= 0) { + ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB); + EVP_MD_free(fetched); + goto err; + } EVP_MD_free(fetched); if (*pbio == NULL) *pbio = btmp; @@ -522,7 +526,11 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) } (void)ERR_pop_to_mark(); - BIO_set_md(btmp, md); + if (BIO_set_md(btmp, md) <= 0) { + EVP_MD_free(evp_md); + ERR_raise(ERR_LIB_PKCS7, ERR_R_BIO_LIB); + goto err; + } EVP_MD_free(evp_md); if (out == NULL) out = btmp; -- GitLab