Date: Fri, 10 Mar 2023 20:32:14 GMT From: Cy Schubert <cy@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 59c26d1a95a0 - stable/13 - heimdal: Fix CVE-2022-4152, signature validation error Message-ID: <202303102032.32AKWEY4095868@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=59c26d1a95a00418892e08341e3eae074c238680 commit 59c26d1a95a00418892e08341e3eae074c238680 Author: Cy Schubert <cy@FreeBSD.org> AuthorDate: 2023-03-10 01:03:52 +0000 Commit: Cy Schubert <cy@FreeBSD.org> CommitDate: 2023-03-10 04:07:25 +0000 heimdal: Fix CVE-2022-4152, signature validation error When CVE-2022-3437 was fixed by changing memcmp to be a constant time and the workaround for th e compiler was to add "!=0". However the logic implmented was inverted resulting in CVE-2022-4152. Reported by: Timothy E Zingelman <zingelman _AT_ fnal.gov> Security: CVE-2022-4152 Security: https://www.cve.org/CVERecord?id=CVE-2022-45142 Security: https://nvd.nist.gov/vuln/detail/CVE-2022-45142 Security: https://security-tracker.debian.org/tracker/CVE-2022-45142 Security: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2022-45142 Security: https://bugzilla.samba.org/show_bug.cgi?id=15296 Security: https://www.openwall.com/lists/oss-security/2023/02/08/1 (cherry picked from commit 5abaf0866445a61c11665fffc148ecd13a7bb9ac) --- crypto/heimdal/lib/gssapi/krb5/arcfour.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/crypto/heimdal/lib/gssapi/krb5/arcfour.c b/crypto/heimdal/lib/gssapi/krb5/arcfour.c index 3b8d452877dd..7d1143c95d83 100644 --- a/crypto/heimdal/lib/gssapi/krb5/arcfour.c +++ b/crypto/heimdal/lib/gssapi/krb5/arcfour.c @@ -307,7 +307,7 @@ _gssapi_verify_mic_arcfour(OM_uint32 * minor_status, return GSS_S_FAILURE; } - cmp = (ct_memcmp(cksum_data, p + 8, 8) == 0); + cmp = (ct_memcmp(cksum_data, p + 8, 8) != 0); if (cmp) { *minor_status = 0; return GSS_S_BAD_MIC; @@ -695,7 +695,7 @@ OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status, return GSS_S_FAILURE; } - cmp = (ct_memcmp(cksum_data, p0 + 16, 8) == 0); /* SGN_CKSUM */ + cmp = (ct_memcmp(cksum_data, p0 + 16, 8) != 0); /* SGN_CKSUM */ if (cmp) { _gsskrb5_release_buffer(minor_status, output_message_buffer); *minor_status = 0;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202303102032.32AKWEY4095868>