Skip to content

Commit 06d5e28

Browse files
[AUTO-CHERRYPICK] libtasn1: Address CVE-2024-12133 [High] - branch 3.0-dev (#12709)
Co-authored-by: Ankita Pareek <[email protected]>
1 parent 0799636 commit 06d5e28

File tree

6 files changed

+245
-10
lines changed

6 files changed

+245
-10
lines changed

SPECS/libtasn1/CVE-2024-12133.patch

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
From 869a97aa259dffa2620dabcad84e1c22545ffc3d Mon Sep 17 00:00:00 2001
2+
From: Daiki Ueno <[email protected]>
3+
Date: Fri, 8 Nov 2024 16:05:32 +0900
4+
Subject: [PATCH] asn1_find_node: optimize "?NUMBER" node lookup with indexing
5+
6+
To avoid linear search of named nodes, this adds a array of child
7+
nodes to their parent nodes as a cache.
8+
9+
Signed-off-by: Daiki Ueno <[email protected]>
10+
Signed-off-by: Simon Josefsson <[email protected]>
11+
---
12+
lib/element.c | 56 ++++++++++++++++++++++++++++++++++++++++++------
13+
lib/element.h | 10 +++++++++
14+
lib/int.h | 8 +++++++
15+
lib/parser_aux.c | 10 +++++++++
16+
lib/structure.c | 13 +++++++++++
17+
5 files changed, 90 insertions(+), 7 deletions(-)
18+
19+
diff --git a/lib/element.c b/lib/element.c
20+
index 850bef4a..528df418 100644
21+
--- a/lib/element.c
22+
+++ b/lib/element.c
23+
@@ -33,6 +33,8 @@
24+
#include "structure.h"
25+
#include "c-ctype.h"
26+
#include "element.h"
27+
+#include <limits.h>
28+
+#include "intprops.h"
29+
30+
void
31+
_asn1_hierarchical_name (asn1_node_const node, char *name, int name_size)
32+
@@ -129,6 +131,41 @@ _asn1_convert_integer (const unsigned char *value, unsigned char *value_out,
33+
return ASN1_SUCCESS;
34+
}
35+
36+
+int
37+
+_asn1_node_array_set (struct asn1_node_array_st *array, size_t position,
38+
+ asn1_node node)
39+
+{
40+
+ if (position >= array->size)
41+
+ {
42+
+ size_t new_size = position, i;
43+
+ asn1_node *new_nodes;
44+
+
45+
+ if (INT_MULTIPLY_OVERFLOW (new_size, 2))
46+
+ return ASN1_GENERIC_ERROR;
47+
+ new_size *= 2;
48+
+
49+
+ if (INT_ADD_OVERFLOW (new_size, 1))
50+
+ return ASN1_GENERIC_ERROR;
51+
+ new_size += 1;
52+
+
53+
+ if (INT_MULTIPLY_OVERFLOW (new_size, sizeof (*new_nodes)))
54+
+ return ASN1_GENERIC_ERROR;
55+
+
56+
+ new_nodes = realloc (array->nodes, new_size * sizeof (*new_nodes));
57+
+ if (!new_nodes)
58+
+ return ASN1_MEM_ALLOC_ERROR;
59+
+
60+
+ for (i = array->size; i < new_size; i++)
61+
+ new_nodes[i] = NULL;
62+
+
63+
+ array->nodes = new_nodes;
64+
+ array->size = new_size;
65+
+ }
66+
+
67+
+ array->nodes[position] = node;
68+
+ return ASN1_SUCCESS;
69+
+}
70+
+
71+
/* Appends a new element into the sequence (or set) defined by this
72+
* node. The new element will have a name of '?number', where number
73+
* is a monotonically increased serial number.
74+
@@ -145,6 +182,7 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache)
75+
asn1_node p, p2;
76+
char temp[LTOSTR_MAX_SIZE + 1];
77+
long n;
78+
+ int result;
79+
80+
if (!node || !(node->down))
81+
return ASN1_GENERIC_ERROR;
82+
@@ -177,17 +215,21 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache)
83+
pcache->tail = p2;
84+
}
85+
86+
- if (p->name[0] == 0)
87+
- _asn1_str_cpy (temp, sizeof (temp), "?1");
88+
- else
89+
+ n = 0;
90+
+ if (p->name[0] != 0)
91+
{
92+
- n = strtol (p->name + 1, NULL, 0);
93+
- n++;
94+
- temp[0] = '?';
95+
- _asn1_ltostr (n, temp + 1);
96+
+ n = strtol (p->name + 1, NULL, 10);
97+
+ if (n <= 0 || n >= LONG_MAX - 1)
98+
+ return ASN1_GENERIC_ERROR;
99+
}
100+
+ temp[0] = '?';
101+
+ _asn1_ltostr (n + 1, temp + 1);
102+
_asn1_set_name (p2, temp);
103+
/* p2->type |= CONST_OPTION; */
104+
+ result = _asn1_node_array_set (&node->numbered_children, n, p2);
105+
+ if (result != ASN1_SUCCESS)
106+
+ return result;
107+
+ p2->parent = node;
108+
109+
return ASN1_SUCCESS;
110+
}
111+
diff --git a/lib/element.h b/lib/element.h
112+
index 732054e9..b84e3a27 100644
113+
--- a/lib/element.h
114+
+++ b/lib/element.h
115+
@@ -38,4 +38,14 @@ int _asn1_convert_integer (const unsigned char *value,
116+
void _asn1_hierarchical_name (asn1_node_const node, char *name,
117+
int name_size);
118+
119+
+static inline asn1_node_const
120+
+_asn1_node_array_get (const struct asn1_node_array_st *array, size_t position)
121+
+{
122+
+ return position < array->size ? array->nodes[position] : NULL;
123+
+}
124+
+
125+
+int
126+
+_asn1_node_array_set (struct asn1_node_array_st *array, size_t position,
127+
+ asn1_node node);
128+
+
129+
#endif
130+
diff --git a/lib/int.h b/lib/int.h
131+
index 4f2d98d1..41b12b0b 100644
132+
--- a/lib/int.h
133+
+++ b/lib/int.h
134+
@@ -31,6 +31,12 @@
135+
136+
# define ASN1_SMALL_VALUE_SIZE 16
137+
138+
+struct asn1_node_array_st
139+
+{
140+
+ asn1_node *nodes;
141+
+ size_t size;
142+
+};
143+
+
144+
/* This structure is also in libtasn1.h, but then contains less
145+
fields. You cannot make any modifications to these first fields
146+
without breaking ABI. */
147+
@@ -47,6 +53,8 @@ struct asn1_node_st
148+
asn1_node left; /* Pointer to the next list element */
149+
/* private fields: */
150+
unsigned char small_value[ASN1_SMALL_VALUE_SIZE]; /* For small values */
151+
+ asn1_node parent; /* Pointer to the parent node */
152+
+ struct asn1_node_array_st numbered_children; /* Array of unnamed child nodes for caching */
153+
154+
/* values used during decoding/coding */
155+
int tmp_ival;
156+
diff --git a/lib/parser_aux.c b/lib/parser_aux.c
157+
index 415905a0..4281cc97 100644
158+
--- a/lib/parser_aux.c
159+
+++ b/lib/parser_aux.c
160+
@@ -126,6 +126,7 @@ asn1_find_node (asn1_node_const pointer, const char *name)
161+
const char *n_start;
162+
unsigned int nsize;
163+
unsigned int nhash;
164+
+ const struct asn1_node_array_st *numbered_children;
165+
166+
if (pointer == NULL)
167+
return NULL;
168+
@@ -209,6 +210,7 @@ asn1_find_node (asn1_node_const pointer, const char *name)
169+
if (p->down == NULL)
170+
return NULL;
171+
172+
+ numbered_children = &p->numbered_children;
173+
p = p->down;
174+
if (p == NULL)
175+
return NULL;
176+
@@ -222,6 +224,12 @@ asn1_find_node (asn1_node_const pointer, const char *name)
177+
}
178+
else
179+
{ /* no "?LAST" */
180+
+ if (n[0] == '?' && c_isdigit (n[1]))
181+
+ {
182+
+ long position = strtol (n + 1, NULL, 10);
183+
+ if (position > 0 && position < LONG_MAX)
184+
+ p = _asn1_node_array_get (numbered_children, position - 1);
185+
+ }
186+
while (p)
187+
{
188+
if (p->name_hash == nhash && !strcmp (p->name, n))
189+
@@ -509,6 +517,8 @@ _asn1_remove_node (asn1_node node, unsigned int flags)
190+
if (node->value != node->small_value)
191+
free (node->value);
192+
}
193+
+
194+
+ free (node->numbered_children.nodes);
195+
free (node);
196+
}
197+
198+
diff --git a/lib/structure.c b/lib/structure.c
199+
index 9c95b9e2..32692ad2 100644
200+
--- a/lib/structure.c
201+
+++ b/lib/structure.c
202+
@@ -31,6 +31,9 @@
203+
#include <structure.h>
204+
#include "parser_aux.h"
205+
#include <gstr.h>
206+
+#include "c-ctype.h"
207+
+#include "element.h"
208+
+#include <limits.h>
209+
210+
211+
extern char _asn1_identifierMissing[];
212+
@@ -391,6 +394,16 @@ asn1_delete_element (asn1_node structure, const char *element_name)
213+
if (source_node == NULL)
214+
return ASN1_ELEMENT_NOT_FOUND;
215+
216+
+ if (source_node->parent
217+
+ && source_node->name[0] == '?'
218+
+ && c_isdigit (source_node->name[1]))
219+
+ {
220+
+ long position = strtol (source_node->name + 1, NULL, 10);
221+
+ if (position > 0 && position < LONG_MAX)
222+
+ _asn1_node_array_set (&source_node->parent->numbered_children,
223+
+ position - 1, NULL);
224+
+ }
225+
+
226+
p2 = source_node->right;
227+
p3 = _asn1_find_left (source_node);
228+
if (!p3)
229+
--
230+
GitLab
231+

SPECS/libtasn1/libtasn1.spec

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
Summary: ASN.1 library
22
Name: libtasn1
33
Version: 4.19.0
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: GPLv3+ AND LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
Group: System Environment/Libraries
99
URL: https://www.gnu.org/software/libtasn1/
1010
Source0: https://ftp.gnu.org/gnu/libtasn1/%{name}-%{version}.tar.gz
11+
Patch0: CVE-2024-12133.patch
1112
Provides: libtasn1-tools = %{version}-%{release}
1213

1314
%description
@@ -23,7 +24,7 @@ The package contains libraries and header files for
2324
developing applications that use libtasn1.
2425

2526
%prep
26-
%setup -q
27+
%autosetup -p1
2728

2829
%build
2930
./configure \
@@ -57,6 +58,9 @@ make %{?_smp_mflags} check
5758
%{_mandir}/man3/*
5859

5960
%changelog
61+
* Fri Feb 21 2024 Ankita Pareek <[email protected]> - 4.19.0-2
62+
- Address CVE-2024-12133
63+
6064
* Tue Oct 25 2022 Pawel Winogrodzki <[email protected]> - 4.19.0-1
6165
- Updating to version 4.19.0 to fix CVE-2021-46848.
6266

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ azurelinux-repos-shared-3.0-4.azl3.noarch.rpm
235235
azurelinux-repos-3.0-4.azl3.noarch.rpm
236236
libffi-3.4.4-1.azl3.aarch64.rpm
237237
libffi-devel-3.4.4-1.azl3.aarch64.rpm
238-
libtasn1-4.19.0-1.azl3.aarch64.rpm
238+
libtasn1-4.19.0-2.azl3.aarch64.rpm
239239
p11-kit-0.25.0-1.azl3.aarch64.rpm
240240
p11-kit-trust-0.25.0-1.azl3.aarch64.rpm
241241
ca-certificates-shared-3.0.0-8.azl3.noarch.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ azurelinux-repos-shared-3.0-4.azl3.noarch.rpm
235235
azurelinux-repos-3.0-4.azl3.noarch.rpm
236236
libffi-3.4.4-1.azl3.x86_64.rpm
237237
libffi-devel-3.4.4-1.azl3.x86_64.rpm
238-
libtasn1-4.19.0-1.azl3.x86_64.rpm
238+
libtasn1-4.19.0-2.azl3.x86_64.rpm
239239
p11-kit-0.25.0-1.azl3.x86_64.rpm
240240
p11-kit-trust-0.25.0-1.azl3.x86_64.rpm
241241
ca-certificates-shared-3.0.0-8.azl3.noarch.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -232,9 +232,9 @@ libssh2-debuginfo-1.11.0-1.azl3.aarch64.rpm
232232
libssh2-devel-1.11.0-1.azl3.aarch64.rpm
233233
libstdc++-13.2.0-7.azl3.aarch64.rpm
234234
libstdc++-devel-13.2.0-7.azl3.aarch64.rpm
235-
libtasn1-4.19.0-1.azl3.aarch64.rpm
236-
libtasn1-debuginfo-4.19.0-1.azl3.aarch64.rpm
237-
libtasn1-devel-4.19.0-1.azl3.aarch64.rpm
235+
libtasn1-4.19.0-2.azl3.aarch64.rpm
236+
libtasn1-debuginfo-4.19.0-2.azl3.aarch64.rpm
237+
libtasn1-devel-4.19.0-2.azl3.aarch64.rpm
238238
libtool-2.4.7-1.azl3.aarch64.rpm
239239
libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
240240
libxcrypt-4.4.36-2.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -240,9 +240,9 @@ libssh2-debuginfo-1.11.0-1.azl3.x86_64.rpm
240240
libssh2-devel-1.11.0-1.azl3.x86_64.rpm
241241
libstdc++-13.2.0-7.azl3.x86_64.rpm
242242
libstdc++-devel-13.2.0-7.azl3.x86_64.rpm
243-
libtasn1-4.19.0-1.azl3.x86_64.rpm
244-
libtasn1-debuginfo-4.19.0-1.azl3.x86_64.rpm
245-
libtasn1-devel-4.19.0-1.azl3.x86_64.rpm
243+
libtasn1-4.19.0-2.azl3.x86_64.rpm
244+
libtasn1-debuginfo-4.19.0-2.azl3.x86_64.rpm
245+
libtasn1-devel-4.19.0-2.azl3.x86_64.rpm
246246
libtool-2.4.7-1.azl3.x86_64.rpm
247247
libtool-debuginfo-2.4.7-1.azl3.x86_64.rpm
248248
libxml2-2.11.5-4.azl3.x86_64.rpm

0 commit comments

Comments
 (0)