From f3a7e57c92b2c9b87dc4b2997f2ebda6781300d0 Mon Sep 17 00:00:00 2001 From: Andy Polyakov Date: Thu, 19 Jan 2017 00:17:30 +0100 Subject: [PATCH] crypto/evp: harden RC4_MD5 cipher. MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Originally a crash in 32-bit build was reported CHACHA20-POLY1305 cipher. The crash is triggered by truncated packet and is result of excessive hashing to the edge of accessible memory (or bogus MAC value is produced if x86 MD5 assembly module is involved). Since hash operation is read-only it is not considered to be exploitable beyond a DoS condition. Thanks to Robert Święcki for report. CVE-2017-3731 Reviewed-by: Rich Salz --- crypto/evp/e_rc4_hmac_md5.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c index 828ed64415..8ab18c1413 100644 --- a/crypto/evp/e_rc4_hmac_md5.c +++ b/crypto/evp/e_rc4_hmac_md5.c @@ -219,6 +219,8 @@ static int rc4_hmac_md5_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, len = p[arg - 2] << 8 | p[arg - 1]; if (!EVP_CIPHER_CTX_encrypting(ctx)) { + if (len < MD5_DIGEST_LENGTH) + return -1; len -= MD5_DIGEST_LENGTH; p[arg - 2] = len >> 8; p[arg - 1] = len; -- 2.25.1