File openssl-CVE-2016-6304.patch of Package openssl.10986

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2016-6304.patch of Package openssl.10986

commit 2c0d295e26306e15a92eb23a84a1802005c1c137
Author: Matt Caswell <matt@openssl.org>
Date:   Fri Sep 9 10:08:45 2016 +0100

Fix OCSP Status Request extension unbounded memory growth
    
    A malicious client can send an excessively large OCSP Status Request
    extension. If that client continually requests renegotiation,
    sending a large OCSP Status Request extension each time, then there will
    be unbounded memory growth on the server. This will eventually lead to a
    Denial Of Service attack through memory exhaustion. Servers with a
    default configuration are vulnerable even if they do not support OCSP.
    Builds using the "no-ocsp" build time option are not affected.
    
    I have also checked other extensions to see if they suffer from a similar
    problem but I could not find any other issues.
    
    CVE-2016-6304
    
    Issue reported by Shi Lei.
    
    Reviewed-by: Rich Salz <rsalz@openssl.org>

Index: openssl-1.0.1i/ssl/t1_lib.c
===================================================================
--- openssl-1.0.1i.orig/ssl/t1_lib.c	2016-09-22 14:23:45.730406598 +0200
+++ openssl-1.0.1i/ssl/t1_lib.c	2016-09-22 14:28:12.846521552 +0200
@@ -1327,6 +1327,23 @@ int ssl_parse_clienthello_tlsext(SSL *s,
 					*al = SSL_AD_DECODE_ERROR;
 					return 0;
 					}
+
+                		/*
+                 		 * We remove any OCSP_RESPIDs from a previous handshake
+                 		 * to prevent unbounded memory growth - CVE-2016-6304
+                 		 */
+                		sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids,
+                                        		OCSP_RESPID_free);
+                		if (dsize > 0) {
+                    			s->tlsext_ocsp_ids = sk_OCSP_RESPID_new_null();
+                    			if (s->tlsext_ocsp_ids == NULL) {
+                        			*al = SSL_AD_INTERNAL_ERROR;
+                        			return 0;
+                    			}
+                		} else {
+                    				s->tlsext_ocsp_ids = NULL;
+                		}
+
 				while (dsize > 0)
 					{
 					OCSP_RESPID *id;
@@ -1359,14 +1376,6 @@ int ssl_parse_clienthello_tlsext(SSL *s,
 						*al = SSL_AD_DECODE_ERROR;
 						return 0;
 						}
-					if (!s->tlsext_ocsp_ids
-						&& !(s->tlsext_ocsp_ids =
-						sk_OCSP_RESPID_new_null()))
-						{
-						OCSP_RESPID_free(id);
-						*al = SSL_AD_INTERNAL_ERROR;
-						return 0;
-						}
 					if (!sk_OCSP_RESPID_push(
 							s->tlsext_ocsp_ids, id))
 						{

Places

File openssl-CVE-2016-6304.patch of Package openssl.10986

Places