mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-05 08:02:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

openssl: CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL encryption

Browse Source 
Upstream-Status: Backport from https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b]
Description:
	CVE-2022-3358 openssl: Using a Custom Cipher with NID_undef may lead to NULL encryption.
Affects "openssl < 3.0.6"

(From OE-Core rev: 098e89e89eb58f7d0a6004d4672f3d7365c329dc)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f98b2273c6f03f8f6029a7a409600ce290817e27)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 08b32d2b35c2ba63774d098af467d1c723b1b6e6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hitendra Prajapati
2022-11-03 17:00:38 -10:00
committed by Richard Purdie
parent fc2b5af5e0
commit 32e1f2be0f
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
meta/recipes-connectivity/openssl/openssl/CVE-2022-3358.patch Normal file
View File

@@ -0,0 +1,55 @@
From 56e1d693f0ec5550a8e3dd52d30e57a02f0287af Mon Sep 17 00:00:00 2001
From: Hitendra Prajapati <hprajapati@mvista.com>
Date: Wed, 19 Oct 2022 11:08:23 +0530
Subject: [PATCH] CVE-2022-3358
Upstream-Status: Backport [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b]
CVE : CVE-2022-3358
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
crypto/evp/digest.c | 4 +++-
crypto/evp/evp_enc.c | 6 ++++--
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index de9a1dc..e6e03ea 100644
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -225,7 +225,9 @@ static int evp_md_init_internal(EVP_MD_CTX *ctx, const EVP_MD *type,
|| tmpimpl != NULL
#endif
|| (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) != 0
- || type->origin == EVP_ORIG_METH) {
+ || (type != NULL && type->origin == EVP_ORIG_METH)
+ || (type == NULL && ctx->digest != NULL
+ && ctx->digest->origin == EVP_ORIG_METH)) {
if (ctx->digest == ctx->fetched_digest)
ctx->digest = NULL;
EVP_MD_free(ctx->fetched_digest);
diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index 19a07de..5df08bd 100644
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -131,7 +131,10 @@ static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx,
#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
|| tmpimpl != NULL
#endif
- || impl != NULL) {
+ || impl != NULL
+ || (cipher != NULL && cipher->origin == EVP_ORIG_METH)
+ || (cipher == NULL && ctx->cipher != NULL
+ && ctx->cipher->origin == EVP_ORIG_METH)) {
if (ctx->cipher == ctx->fetched_cipher)
ctx->cipher = NULL;
EVP_CIPHER_free(ctx->fetched_cipher);
@@ -147,7 +150,6 @@ static int evp_cipher_init_internal(EVP_CIPHER_CTX *ctx,
ctx->cipher_data = NULL;
}
-
/* Start of non-legacy code below */
/* Ensure a context left lying around from last time is cleared */
--
2.25.1

1
meta/recipes-connectivity/openssl/openssl_3.0.5.bb
View File

@@ -12,6 +12,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
file://afalg.patch \
file://0001-Configure-do-not-tweak-mips-cflags.patch \
file://CVE-2022-3358.patch \
"
SRC_URI:append:class-nativesdk = " \