Headline
CVE-2022-45142: security - [vs] heimdal: CVE-2022-45142: signature validation failure
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding “!= 0” comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Products
- Openwall GNU/*/Linux server OS
- Linux Kernel Runtime Guard
- John the Ripper password cracker
- Free & Open Source for any platform
- in the cloud
- Pro for Linux
- Pro for macOS
- Wordlists for password cracking
- passwdqc policy enforcement
- Free & Open Source for Unix
- Pro for Windows (Active Directory)
- yescrypt KDF & password hashing
- yespower Proof-of-Work (PoW)
- crypt_blowfish password hashing
- phpass ditto in PHP
- tcb better password shadowing
- Pluggable Authentication Modules
- scanlogd port scan detector
- popa3d tiny POP3 daemon
- blists web interface to mailing lists
- msulogin single user mode login
- php_mt_seed mt_rand() cracker
- Services
- Publications
- Articles
- Presentations
- Resources
- Mailing lists
- Community wiki
- Source code repositories (GitHub)
- Source code repositories (CVSweb)
- File archive & mirrors
- How to verify digital signatures
- OVE IDs
- What’s new
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 8 Feb 2023 06:45:22 +0100 From: Helmut Grohne <helmut@…divi.de> To: oss-security@…ts.openwall.com Subject: [vs] heimdal: CVE-2022-45142: signature validation failure
Hi,
I am hereby publishing a vulnerability in heimdal backports by attaching the exact mail sent to distros@…openwall.org last week.
----- Forwarded message from Helmut Grohne <helmut@…divi.de> -----
Date: Tue, 31 Jan 2023 15:52:58 +0100 From: Helmut Grohne <helmut@…divi.de> To: distros@…openwall.org Cc: heimdal-security@…mdal.team, Andrew Bartlett <abartlet@…ba.org>, Jeffrey Altman <jaltman@…ure-endpoints.com>, Joseph Sutton <josephsutton@…alyst.net.nz>, Nicolas Williams <nico@…sigma.com>, “Roberto C. Sánchez” <roberto@…exian.com>, Salvatore Bonaccorso <carnil@…ian.org> Subject: [vs] heimdal: CVE-2022-45142: signature validation failure
(Resent with proper subject tag)
CVE-2022-3437 was a vulnerability affecting heimdal and samba. It was fixed in both places. The fix included changing memcmp to be constant time and a workaround for a compiler bug by adding “!= 0” comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
This vulnerability does not affect samba nor the main heimdal branch and only applies to backports. At least the 7.7.1 and 7.8.0 branches are affected. CVE-2022-45142 has been assigned. All releases of Debian are affected. At least one release of Fedora and Ubuntu are affected.
Timeline of events
2022-12-09 Issue discovered by me during backporting of patches 2022-12-09 Notified Debian security team 2022-12-09 Notified heimdal and samba 2022-12-09 Jeffrey Altman (heimdal) confirmed the problem 2022-12-10 Andrew Bartlett (samba) replied as not affected 2022-12-13 Patch v1 2022-12-13 Jeffrey Altman (heimdal) reviewed the patch 2022-12-13 Patch v2 (updated commit message) 2022-12-22 Last reply from heimdal (Jeffrey Altman) asking for more time 2022-12-25 Ping 2023-01-04 Ping 2023-01-13 Ping 2023-01-20 Ping and notified Ubuntu security team 2023-01-30 CVE-2022-45142 assigned 2023-01-31 Unilateral disclosure to distros mailinglist 2023-02-08 Proposed public disclosure to oss-sec
I would like to thank Salvatore Bonaccorso for handling most of the coordination. Thanks also to go Jeffrey Altman and Andrew Bartlett for their timely replies. My work on this issue is paid by Freexian SARL.
Patch below
Helmut
From: Helmut Grohne <helmut@…divi.de> Subject: [PATCH v3] CVE-2022-45142: gsskrb5: fix accidental logic inversions
The referenced commit attempted to fix miscompilations with gcc-9 and gcc-10 by changing `memcmp(…)` to `memcmp(…) != 0`. Unfortunately, it also inverted the result of the comparison in two occasions. This inversion happened during backporting the patch to 7.7.1 and 7.8.0.
Fixes: f6edaafcfefd (“gsskrb5: CVE-2022-3437 Use constant-time memcmp() for arcfour unwrap”) Signed-off-by: Helmut Grohne <helmut@…divi.de>
lib/gssapi/krb5/arcfour.c | 4 +±- 1 file changed, 2 insertions(+), 2 deletions(-)
Changes since v1: * Fix typo in commit message. * Mention 7.8.0 in commit message. Thanks to Jeffrey Altman.
Changes since v2: * Add CVE identifier.
diff --git a/lib/gssapi/krb5/arcfour.c b/lib/gssapi/krb5/arcfour.c index e838d007a…eee6ad72f 100644 — a/lib/gssapi/krb5/arcfour.c +++ b/lib/gssapi/krb5/arcfour.c @@ -365,7 +365,7 @@ _gssapi_verify_mic_arcfour(OM_uint32 * minor_status, return GSS_S_FAILURE; }
- cmp = (ct_memcmp(cksum_data, p + 8, 8) == 0);
- cmp = (ct_memcmp(cksum_data, p + 8, 8) != 0); if (cmp) { *minor_status = 0; return GSS_S_BAD_MIC; @@ -730,7 +730,7 @@ OM_uint32 _gssapi_unwrap_arcfour(OM_uint32 *minor_status, return GSS_S_FAILURE; }
- cmp = (ct_memcmp(cksum_data, p0 + 16, 8) == 0); /* SGN_CKSUM */
- cmp = (ct_memcmp(cksum_data, p0 + 16, 8) != 0); /* SGN_CKSUM */ if (cmp) { _gsskrb5_release_buffer(minor_status, output_message_buffer); *minor_status = 0; – 2.38.1
----- End forwarded message -----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.
Related news
Gentoo Linux Security Advisory 202310-6 - Multiple vulnerabilities have been discovered in Heimdal, the worst of which could lead to remote code execution on a KDC. Versions greater than or equal to 7.8.0-r1 are affected.
Gentoo Linux Security Advisory 202309-6 - Multiple vulnerabilities have been discovered in Samba, the worst of which could result in root remote code execution. Versions greater than or equal to 4.18.4 are affected.
Ubuntu Security Notice 5936-1 - Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. Tom Tervoort discovered that Samba incorrectly used weak rc4-hmac Kerberos keys. A remote attacker could possibly use this issue to elevate privileges.
Ubuntu Security Notice 5849-1 - Helmut Grohne discovered that Heimdal GSSAPI incorrectly handled logical conditions that are related to memory management operations. An attacker could possibly use this issue to cause a denial of service.
Debian Linux Security Advisory 5344-1 - Helmut Grohne discovered a flaw in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos. The backports of fixes for CVE-2022-3437 accidentally inverted important memory comparisons in the arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi, resulting in incorrect validation of message integrity codes.
Debian Linux Security Advisory 5344-1 - Helmut Grohne discovered a flaw in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos. The backports of fixes for CVE-2022-3437 accidentally inverted important memory comparisons in the arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi, resulting in incorrect validation of message integrity codes.
Ubuntu Security Notice 5822-2 - USN-5822-1 fixed vulnerabilities in Samba. The update for Ubuntu 20.04 LTS introduced regressions in certain environments. Pending investigation of these regressions, this update temporarily reverts the security fixes. It was discovered that Samba incorrectly handled the bad password count logic. It was discovered that Samba supported weak RC4/HMAC-MD5 in NetLogon Secure Channel. Greg Hudson discovered that Samba incorrectly handled PAC parsing. Joseph Sutton discovered that Samba could be forced to issue rc4-hmac encrypted Kerberos tickets.
Ubuntu Security Notice 5822-1 - It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service.
Ubuntu Security Notice 5800-1 - It was discovered that Heimdal incorrectly handled certain SPNEGO tokens. A remote attacker could possibly use this issue to cause a denial of service. Evgeny Legerov discovered that Heimdal incorrectly handled memory when performing certain DES decryption operations. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
Debian Linux Security Advisory 5287-1 - Several vulnerabilities were discovered in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos.
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.