1. openvpn
  2. Commit cb4e35ece4a5b70b10ef9013be3bff263d82f32b
Browse code

Fix potential double-free in --x509-alt-username (CVE-2017-7521)

We didn't check the return value of ASN1_STRING_to_UTF8() in
extract_x509_extension(). Ignoring such a failure could result in buf
being free'd twice. An error in ASN1_STRING_to_UTF8() can be caused
remotely if the peer can make the local process run out of memory.

The problem can only be triggered for configurations that use the
--x509-alt-username option with an x509 extension (i.e. the option
parameter starts with "ext:").

This issue was discovered, analysed and reported to the OpenVPN team by
Guido Vranken.

Extensive testing by Guido Vranken gives confidence that this function
is very unlikely to fail in real-world usage (using subjectAltName or
issuerAltName extensions) for other reasons than memory exhaustion.

CVE: 2017-7521
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: David Sommerseth <davids@openvpn.net>
Acked-by: Guido Vranken <guidovranken@gmail.com>
Message-Id: <1497864520-12219-6-git-send-email-steffan.karger@fox-it.com>
URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-6-git-send-email-steffan.karger@fox-it.com
Signed-off-by: Gert Doering <gert@greenie.muc.de>

Steffan Karger authored on 2017/06/19 18:28:40
Showing 2 changed files
Changes.rst
History View file @ cb4e35e
... ... 
@@ -318,6 +318,13 @@ Security
318 318 
   server.  That can eventuall cause the server to run out of memory, and thereby
319 319 
   causing the server process to terminate. Discovered and reported to the
320 320 
   OpenVPN security team by Guido Vranken.  (OpenSSL builds only.)
321 
+- CVE-2017-7521: Fix a potential post-authentication remote code execution
322 
+  attack on servers that use the ``--x509-alt-username`` option with an X.509
323 
+  extension field (option argument prefixed with ``ext:``).  A client that can
324 
+  cause a server to run out-of-memory (see above) might be able to cause the
325 
+  server to double free, which in turn might lead to remote code execution.
326 
+  Discovered and reported to the OpenVPN security team by Guido Vranken.
327 
+  (OpenSSL builds only.)
321 328
322 329 
 User-visible Changes
323 330 
 --------------------
src/openvpn/ssl_verify_openssl.c
History View file @ cb4e35e
... ... 
@@ -156,7 +156,10 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, int size)
156 156 
             switch (name->type)
157 157 
             {
158 158 
                 case GEN_EMAIL:
159 
-                    ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5);
159 
+                    if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0)
160 
+                    {
161 
+                        continue;
162 
+                    }
160 163 
                     if (strlen(buf) != name->d.ia5->length)
161 164 
                     {
162 165 
                         msg(D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero");