1. photon
  2. Commit ca526f7b8f9f382999263ee7c879a6fc7312941a
Browse code

strongswan : Fix CVE-2017-11185

Change-Id: Ia61d48c9fdecccb8384f8ff15608727dfa5ad5f4
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4101
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

xiaolin-vmware authored on 2017/10/21 03:02:06
Showing 2 changed files
SPECS/strongswan/strongswan-CVE-2017-11185.patch
History View file @ ca526f7
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,50 @@
0 
+From ed282e9a463c068146c945984fdea7828e663861 Mon Sep 17 00:00:00 2001
1 
+From: Tobias Brunner <tobias@strongswan.org>
2 
+Date: Mon, 29 May 2017 11:59:34 +0200
3 
+Subject: [PATCH] gmp: Fix RSA signature verification for m >= n
4 
+
5 
+By definition, m must be <= n-1, we didn't enforce that and because
6 
+mpz_export() returns NULL if the passed value is zero a crash could have
7 
+been triggered with m == n.
8 
+
9 
+Fixes CVE-2017-11185.
10 
+---
11 
+ src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c | 12 +++++++++---
12 
+ 1 file changed, 9 insertions(+), 3 deletions(-)
13 
+
14 
+diff --git a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c b/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
15 
+index 32a72ac9600b..a741f85d4f62 100644
16 
+--- a/src/libstrongswan/plugins/gmp/gmp_rsa_public_key.c
17 
+@@ -78,11 +78,17 @@ static chunk_t rsaep(private_gmp_rsa_public_key_t *this, chunk_t data)
18 
+ 	mpz_t m, c;
19 
+ 	chunk_t encrypted;
20 
+
21 
+-	mpz_init(c);
22 
+ 	mpz_init(m);
23 
+-
24 
+ 	mpz_import(m, data.len, 1, 1, 1, 0, data.ptr);
25 
+
26 
++	if (mpz_cmp_ui(m, 0) <= 0 || mpz_cmp(m, this->n) >= 0)
27 
++	{	/* m must be <= n-1, but 0 is a valid value, doesn't really make sense
28 
++		 * here, though */
29 
++		mpz_clear(m);
30 
++		return chunk_empty;
31 
++	}
32 
++
33 
++	mpz_init(c);
34 
+ 	mpz_powm(c, m, this->e, this->n);
35 
+
36 
+ 	encrypted.len = this->k;
37 
+@@ -150,7 +156,7 @@ static bool verify_emsa_pkcs1_signature(private_gmp_rsa_public_key_t *this,
38 
+ 	 */
39 
+
40 
+ 	/* check magic bytes */
41 
+-	if (*(em.ptr) != 0x00 || *(em.ptr+1) != 0x01)
42 
++	if (em.len < 2 || *(em.ptr) != 0x00 || *(em.ptr+1) != 0x01)
43 
+ 	{
44 
+ 		goto end;
45 
+ 	}
46 
+--
47 
+2.7.4
48 
+
SPECS/strongswan/strongswan.spec
History View file @ ca526f7
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:          The OpenSource IPsec-based VPN Solution
2 2 
 Name:             strongswan
3 3 
 Version:          5.5.1
4 
-Release:          1%{?dist}
4 
+Release:          2%{?dist}
5 5 
 License:          GPLv2+
6 6 
 URL:              https://www.strongswan.org/
7 7 
 Group:            System Environment/Security
... ... 
@@ -9,7 +9,7 @@ Vendor:           VMware, Inc.
9 9 
 Distribution:     Photon
10 10 
 Source0:          https://download.strongswan.org/strongswan-5.5.1.tar.bz2
11 11 
 %define sha1      strongswan=7d400eb501ac9e41eb889199891457003baa284c
12 
-
12 
+Patch0:           strongswan-CVE-2017-11185.patch
13 13 
 BuildRequires:    autoconf
14 14
15 15 
 %description
... ... 
@@ -17,6 +17,7 @@ strongSwan is a complete IPsec implementation for Linux 2.6, 3.x, and 4.x kernel
17 17
18 18 
 %prep
19 19 
 %setup -q
20 
+%patch0 -p1
20 21
21 22 
 %build
22 23 
 ./configure --prefix=%{_prefix} --sysconfdir=%{_sysconfdir}
... ... 
@@ -49,5 +50,7 @@ rm -rf %{buildroot}/*
49 49
50 50
51 51 
 %changelog
52 
+*   Thu Oct 19 2017 Xiaolin Li <xiaolinl@vmware.com> 5.5.1-2
53 
+-   Fix CVE-2017-11185
52 54 
 *   Wed Dec 21 2016 Xiaolin Li <xiaolinl@vmware.com>  5.5.1-1
53 55 
 -   Initial build.