openssl: fix CVE-2014-0221
http://www.openssl.org/news/secadv_20140605.txt DTLS recursion flaw (CVE-2014-0221) By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. Only applications using OpenSSL as a DTLS client are affected. (Patch borrowed from Fedora.) (From OE-Core rev: 6506f8993c84b966642ef857bb15cf96eada32e8) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
d6f29c0154
commit
bd1a6f3d56
|
@ -0,0 +1,38 @@
|
|||
commit d30e582446b027868cdabd0994681643682045a4
|
||||
Author: Dr. Stephen Henson <steve@openssl.org>
|
||||
Date: Fri May 16 13:00:45 2014 +0100
|
||||
|
||||
Fix CVE-2014-0221
|
||||
|
||||
Unnecessary recursion when receiving a DTLS hello request can be used to
|
||||
crash a DTLS client. Fixed by handling DTLS hello request without recursion.
|
||||
|
||||
Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
|
||||
|
||||
Patch borrowed from Fedora
|
||||
Upstream-Status: Backport
|
||||
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
|
||||
|
||||
diff --git a/ssl/d1_both.c b/ssl/d1_both.c
|
||||
index 07f67f8..4c2fd03 100644
|
||||
--- a/ssl/d1_both.c
|
||||
+++ b/ssl/d1_both.c
|
||||
@@ -793,6 +793,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
|
||||
int i,al;
|
||||
struct hm_header_st msg_hdr;
|
||||
|
||||
+ redo:
|
||||
/* see if we have the required fragment already */
|
||||
if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
|
||||
{
|
||||
@@ -851,8 +852,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
|
||||
s->msg_callback_arg);
|
||||
|
||||
s->init_num = 0;
|
||||
- return dtls1_get_message_fragment(s, st1, stn,
|
||||
- max, ok);
|
||||
+ goto redo;
|
||||
}
|
||||
else /* Incorrectly formated Hello request */
|
||||
{
|
||||
|
|
@ -40,6 +40,7 @@ SRC_URI += "file://configure-targets.patch \
|
|||
file://CVE-2014-0160.patch \
|
||||
file://openssl-1.0.1e-cve-2014-0195.patch \
|
||||
file://openssl-1.0.1e-cve-2014-0198.patch \
|
||||
file://openssl-1.0.1e-cve-2014-0221.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "66bf6f10f060d561929de96f9dfe5b8c"
|
||||
|
|
Loading…
Reference in New Issue