Several of our OpenSSL-specific certificate-parsing code paths did not always clear all allocated memory. Since a client can cause a few bytes of memory to be leaked for each connection attempt, a client can cause a server to run out of memory and thereby kill the server. That makes this a (quite inefficient) DoS attack.
When using the --x509-alt-username option on openssl builds with an extension (argument prefixed with "ext:", e.g. "ext:subjectAltName"), the code would not free all allocated memory. Fix this by using the proper free function. If ASN1_STRING_to_UTF8() returns 0, it didn't fail and *did* allocate memory. So also free the returned buffer if it returns 0. These issues were found, analysed and reported to the OpenVPN team by Guido Vranken. Signed-off-by: Steffan Karger <steffan.kar...@fox-it.com> --- Changes.rst | 5 +++++ src/openvpn/ssl_verify_openssl.c | 9 ++++----- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/Changes.rst b/Changes.rst index f1aed2d..89cfae8 100644 --- a/Changes.rst +++ b/Changes.rst @@ -313,6 +313,11 @@ Security --x509-track option and the client has a correct, signed and unrevoked certificate that contains an embedded NUL in the certificate subject. Discovered and reported to the OpenVPN security team by Guido Vranken. +- CVE-2017-7521: Fix post-authentication remote-triggerable memory leaks + A client could cause a server to leak a few bytes each time it connects to the + server. That can eventuall cause the server to run out of memory, and thereby + causing the server process to terminate. Discovered and reported to the + OpenVPN security team by Guido Vranken. (OpenSSL builds only.) User-visible Changes -------------------- diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c index 31c1638..7c1a481 100644 --- a/src/openvpn/ssl_verify_openssl.c +++ b/src/openvpn/ssl_verify_openssl.c @@ -163,7 +163,7 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, int size) break; } } - sk_GENERAL_NAME_free(extensions); + GENERAL_NAMES_free(extensions); } return retval; } @@ -225,8 +225,7 @@ extract_x509_field_ssl(X509_NAME *x509, const char *field_name, char *out, { return FAILURE; } - tmp = ASN1_STRING_to_UTF8(&buf, asn1); - if (tmp <= 0) + if (ASN1_STRING_to_UTF8(&buf, asn1) < 0) { return FAILURE; } @@ -466,7 +465,7 @@ x509_setenv_track(const struct x509_track *xt, struct env_set *es, const int dep { ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent); unsigned char *buf = NULL; - if (ASN1_STRING_to_UTF8(&buf, val) > 0) + if (ASN1_STRING_to_UTF8(&buf, val) >= 0) { do_setenv_x509(es, xt->name, (char *)buf, depth); OPENSSL_free(buf); @@ -553,7 +552,7 @@ x509_setenv(struct env_set *es, int cert_depth, openvpn_x509_cert_t *peer_cert) { continue; } - if (ASN1_STRING_to_UTF8(&buf, val) <= 0) + if (ASN1_STRING_to_UTF8(&buf, val) < 0) { continue; } -- 2.7.4 ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel