[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120422154456.GA4014@openwall.com>
Date: Sun, 22 Apr 2012 19:44:56 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Tavis Ormandy <taviso@...xchg8b.com>
Subject: Re: OpenSSL ASN1 BIO vulnerability (CVE-2012-2110)
On Sun, Apr 22, 2012 at 04:23:11PM +0400, Solar Designer wrote:
> Tavis posted a followup to my message, where he attached a testcase that
> was unfortunately above oss-security's message size limit - so the
> message did not make it to the list. I've gzip-compressed the file and
> have re-attached it to this message now (it's only 3 KB when compressed).
Turns out that file was mangled in transit. Tavis has posted the
correct one on this URL:
http://lock.cmpxchg8b.com/openssl-1.0.1-testcase-32bit.crt.gz
SHA-256: ac7acb168a6bfd65375eeec072acbf904f0f10e3bc5588c020aed4df4712d066
$ gzip -vl openssl-1.0.1-testcase-32bit.crt.gz
method crc date time compressed uncompressed ratio uncompressed_name
defla 879c374f Apr 22 18:57 1389433 1431655797 99.9% openssl-1.0.1-testcase-32bit.crt
With this one, I am able to trigger a problem on 32-bit (OpenSSL 1.0.0d
with unrelated patches):
$ zcat openssl-1.0.1-testcase-32bit.crt.gz | openssl x509 -inform DER
*** glibc detected *** free(): invalid pointer: 0x45ff0008 ***
Aborted
That's in an OpenVZ container with privvmpages barrier at 3 GB.
With 2 GB, I was getting:
$ zcat openssl-1.0.1-testcase-32bit.crt.gz | openssl x509 -inform DER
unable to load certificate
3083651232:error:07069041:memory buffer routines:BUF_MEM_grow_clean:malloc failure:buffer.c:152:
3083651232:error:0D06B041:asn1 encoding routines:ASN1_D2I_READ_BIO:malloc failure:a_d2i_fp.c:229:
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
