mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-23 00:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

gnupg: CVE-2013-4242

Browse Source 
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x
and possibly other products, allows local users to obtain private RSA
keys via a cache side-channel attack involving the L3 cache, aka
Flush+Reload.

Patch from commit e2202ff2b704623efc6277fb5256e4e15bac5676 in
git://git.gnupg.org/libgcrypt.git

(From OE-Core rev: 0692743b51f7daa0154fd4d8982236b4702ea2da)

Signed-off-by: Yong Zhang <yong.zhang@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Kai Kang
2014-10-15 15:16:31 +08:00
committed by Richard Purdie
parent e93f9a8382
commit 313864bf52
2 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
meta/recipes-support/gnupg/gnupg-1.4.7/CVE-2013-4242.patch Normal file
View File

@@ -0,0 +1,62 @@
From e2202ff2b704623efc6277fb5256e4e15bac5676 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Thu, 25 Jul 2013 11:17:52 +0200
Subject: [PATCH] Mitigate a flush+reload cache attack on RSA secret
exponents.
commit e2202ff2b704623efc6277fb5256e4e15bac5676 from
git://git.gnupg.org/libgcrypt.git
* mpi/mpi-pow.c (gcry_mpi_powm): Always perfrom the mpi_mul for
exponents in secure memory.
Upstream-Status: Backport
Signed-off-by: Kai Kang <kai.kang@windriver.com>
--
The attack is published as http://eprint.iacr.org/2013/448 :
Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel
Attack by Yuval Yarom and Katrina Falkner. 18 July 2013.
Flush+Reload is a cache side-channel attack that monitors access to
data in shared pages. In this paper we demonstrate how to use the
attack to extract private encryption keys from GnuPG. The high
resolution and low noise of the Flush+Reload attack enables a spy
program to recover over 98% of the bits of the private key in a
single decryption or signing round. Unlike previous attacks, the
attack targets the last level L3 cache. Consequently, the spy
program and the victim do not need to share the execution core of
the CPU. The attack is not limited to a traditional OS and can be
used in a virtualised environment, where it can attack programs
executing in a different VM.
Index: gnupg-1.4.7/mpi/mpi-pow.c
===================================================================
--- gnupg-1.4.7.orig/mpi/mpi-pow.c
+++ gnupg-1.4.7/mpi/mpi-pow.c
@@ -212,7 +212,13 @@ mpi_powm( MPI res, MPI base, MPI exponen
tp = rp; rp = xp; xp = tp;
rsize = xsize;
- if( (mpi_limb_signed_t)e < 0 ) {
+ /* To mitigate the Yarom/Falkner flush+reload cache
+ * side-channel attack on the RSA secret exponent, we do
+ * the multiplication regardless of the value of the
+ * high-bit of E. But to avoid this performance penalty
+ * we do it only if the exponent has been stored in secure
+ * memory and we can thus assume it is a secret exponent. */
+ if (esec || (mpi_limb_signed_t)e < 0) {
/*mpihelp_mul( xp, rp, rsize, bp, bsize );*/
if( bsize < KARATSUBA_THRESHOLD ) {
mpihelp_mul( xp, rp, rsize, bp, bsize );
@@ -227,6 +233,8 @@ mpi_powm( MPI res, MPI base, MPI exponen
mpihelp_divrem(xp + msize, 0, xp, xsize, mp, msize);
xsize = msize;
}
+ }
+ if ( (mpi_limb_signed_t)e < 0 ) {
tp = rp; rp = xp; xp = tp;
rsize = xsize;

1
meta/recipes-support/gnupg/gnupg_1.4.7.bb
View File

@@ -17,6 +17,7 @@ SRC_URI = "ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-${PV}.tar.bz2 \
file://curl_typeof_fix_backport.patch \
file://CVE-2013-4351.patch \
file://CVE-2013-4576.patch \
file://CVE-2013-4242.patch \
"
SRC_URI[md5sum] = "b06a141cca5cd1a55bbdd25ab833303c"