|
| 1 | +From 352e78a73c6b92155038f341095ab06753f965ea Mon Sep 17 00:00:00 2001 |
| 2 | +From: Kshitiz Godara < [email protected]> |
| 3 | +Date: Mon, 16 Jun 2025 14:38:07 +0000 |
| 4 | +Subject: [PATCH] Fix for CVE-2017-7526 |
| 5 | + |
| 6 | +Upstream reference: |
| 7 | +https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=e6a3dc9900433bbc8ad362a595a3837318c28fa9 |
| 8 | +--- |
| 9 | + grub-core/lib/libgcrypt/cipher/rsa.c | 85 ++++++++++++++++++---------- |
| 10 | + 1 file changed, 54 insertions(+), 31 deletions(-) |
| 11 | + |
| 12 | +diff --git a/grub-core/lib/libgcrypt/cipher/rsa.c b/grub-core/lib/libgcrypt/cipher/rsa.c |
| 13 | +index ccc9f96..43309f4 100644 |
| 14 | +--- a/grub-core/lib/libgcrypt/cipher/rsa.c |
| 15 | ++++ b/grub-core/lib/libgcrypt/cipher/rsa.c |
| 16 | +@@ -685,53 +685,75 @@ stronger_key_check ( RSA_secret_key *skey ) |
| 17 | + |
| 18 | + |
| 19 | + |
| 20 | +-/**************** |
| 21 | +- * Secret key operation. Encrypt INPUT with SKEY and put result into OUTPUT. |
| 22 | ++/* Secret key operation - standard version. |
| 23 | + * |
| 24 | + * m = c^d mod n |
| 25 | +- * |
| 26 | +- * Or faster: |
| 27 | ++ */ |
| 28 | ++static void |
| 29 | ++secret_core_std (gcry_mpi_t M, gcry_mpi_t C, |
| 30 | ++ gcry_mpi_t D, gcry_mpi_t N) |
| 31 | ++{ |
| 32 | ++ mpi_powm (M, C, D, N); |
| 33 | ++} |
| 34 | ++ |
| 35 | ++ |
| 36 | ++/* Secret key operation - using the CRT. |
| 37 | + * |
| 38 | + * m1 = c ^ (d mod (p-1)) mod p |
| 39 | + * m2 = c ^ (d mod (q-1)) mod q |
| 40 | + * h = u * (m2 - m1) mod q |
| 41 | + * m = m1 + h * p |
| 42 | +- * |
| 43 | +- * Where m is OUTPUT, c is INPUT and d,n,p,q,u are elements of SKEY. |
| 44 | ++ */ |
| 45 | ++static void |
| 46 | ++secret_core_crt (gcry_mpi_t M, gcry_mpi_t C, |
| 47 | ++ gcry_mpi_t D, unsigned int Nlimbs, |
| 48 | ++ gcry_mpi_t P, gcry_mpi_t Q, gcry_mpi_t U) |
| 49 | ++{ |
| 50 | ++ gcry_mpi_t m1 = mpi_alloc_secure ( Nlimbs + 1 ); |
| 51 | ++ gcry_mpi_t m2 = mpi_alloc_secure ( Nlimbs + 1 ); |
| 52 | ++ gcry_mpi_t h = mpi_alloc_secure ( Nlimbs + 1 ); |
| 53 | ++ |
| 54 | ++ /* m1 = c ^ (d mod (p-1)) mod p */ |
| 55 | ++ mpi_sub_ui ( h, P, 1 ); |
| 56 | ++ mpi_fdiv_r ( h, D, h ); |
| 57 | ++ mpi_powm ( m1, C, h, P ); |
| 58 | ++ |
| 59 | ++ /* m2 = c ^ (d mod (q-1)) mod q */ |
| 60 | ++ mpi_sub_ui ( h, Q, 1 ); |
| 61 | ++ mpi_fdiv_r ( h, D, h ); |
| 62 | ++ mpi_powm ( m2, C, h, Q ); |
| 63 | ++ |
| 64 | ++ /* h = u * ( m2 - m1 ) mod q */ |
| 65 | ++ mpi_sub ( h, m2, m1 ); |
| 66 | ++ if ( mpi_has_sign ( h ) ) |
| 67 | ++ mpi_add ( h, h, Q ); |
| 68 | ++ mpi_mulm ( h, U, h, Q ); |
| 69 | ++ |
| 70 | ++ /* m = m1 + h * p */ |
| 71 | ++ mpi_mul ( h, h, P ); |
| 72 | ++ mpi_add ( M, m1, h ); |
| 73 | ++ |
| 74 | ++ mpi_free ( h ); |
| 75 | ++ mpi_free ( m1 ); |
| 76 | ++ mpi_free ( m2 ); |
| 77 | ++} |
| 78 | ++ |
| 79 | ++ |
| 80 | ++/* Secret key operation. |
| 81 | ++ * Encrypt INPUT with SKEY and put result into |
| 82 | ++ * OUTPUT. SKEY has the secret key parameters. |
| 83 | + */ |
| 84 | + static void |
| 85 | + secret(gcry_mpi_t output, gcry_mpi_t input, RSA_secret_key *skey ) |
| 86 | + { |
| 87 | + if (!skey->p || !skey->q || !skey->u) |
| 88 | + { |
| 89 | +- mpi_powm (output, input, skey->d, skey->n); |
| 90 | ++ secret_core_std (output, input, skey->d, skey->n); |
| 91 | + } |
| 92 | + else |
| 93 | + { |
| 94 | +- gcry_mpi_t m1 = mpi_alloc_secure( mpi_get_nlimbs(skey->n)+1 ); |
| 95 | +- gcry_mpi_t m2 = mpi_alloc_secure( mpi_get_nlimbs(skey->n)+1 ); |
| 96 | +- gcry_mpi_t h = mpi_alloc_secure( mpi_get_nlimbs(skey->n)+1 ); |
| 97 | +- |
| 98 | +- /* m1 = c ^ (d mod (p-1)) mod p */ |
| 99 | +- mpi_sub_ui( h, skey->p, 1 ); |
| 100 | +- mpi_fdiv_r( h, skey->d, h ); |
| 101 | +- mpi_powm( m1, input, h, skey->p ); |
| 102 | +- /* m2 = c ^ (d mod (q-1)) mod q */ |
| 103 | +- mpi_sub_ui( h, skey->q, 1 ); |
| 104 | +- mpi_fdiv_r( h, skey->d, h ); |
| 105 | +- mpi_powm( m2, input, h, skey->q ); |
| 106 | +- /* h = u * ( m2 - m1 ) mod q */ |
| 107 | +- mpi_sub( h, m2, m1 ); |
| 108 | +- if ( mpi_is_neg( h ) ) |
| 109 | +- mpi_add ( h, h, skey->q ); |
| 110 | +- mpi_mulm( h, skey->u, h, skey->q ); |
| 111 | +- /* m = m2 + h * p */ |
| 112 | +- mpi_mul ( h, h, skey->p ); |
| 113 | +- mpi_add ( output, m1, h ); |
| 114 | +- |
| 115 | +- mpi_free ( h ); |
| 116 | +- mpi_free ( m1 ); |
| 117 | +- mpi_free ( m2 ); |
| 118 | ++ secret_core_crt (output, input, skey->d, mpi_get_nlimbs (skey->n), |
| 119 | ++ skey->p, skey->q, skey->u); |
| 120 | + } |
| 121 | + } |
| 122 | + |
| 123 | +@@ -778,6 +800,7 @@ rsa_unblind (gcry_mpi_t x, gcry_mpi_t ri, gcry_mpi_t n) |
| 124 | + return y; |
| 125 | + } |
| 126 | + |
| 127 | ++ |
| 128 | + /********************************************* |
| 129 | + ************** interface ****************** |
| 130 | + *********************************************/ |
| 131 | +-- |
| 132 | +2.45.3 |
| 133 | + |
0 commit comments