[Pkg-swan-devel] [Git][debian/strongswan][debian/master] 5 commits: d/patches: libtls-Fix-authentication-bypass-and-expired-pointer added

[Yves-Alexis Perez (@corsac)]

Yves-Alexis Perez pushed to branch debian/master at Debian / strongswan


Commits:
a030ca0a by Yves-Alexis Perez at 2023-02-24T21:27:07+01:00
d/patches: libtls-Fix-authentication-bypass-and-expired-pointer added

Fix authentication bypass and use-after-free in libtls (CVE-2023-26463)

- - - - -
44dedba5 by Yves-Alexis Perez at 2023-02-24T21:56:34+01:00
d/control: replace lsb-base dependency by sysvinit-utils

- - - - -
d21cc208 by Yves-Alexis Perez at 2023-02-26T09:39:28+01:00
d/control: update standards version to 4.6.2

- - - - -
7a036517 by Yves-Alexis Perez at 2023-02-26T09:40:02+01:00
finalize changelog

- - - - -
190b82e5 by Yves-Alexis Perez at 2023-02-26T09:40:13+01:00
upload strongSwan 5.9.8-4 to unstable

- - - - -


4 changed files:

- debian/changelog
- debian/control
- + debian/patches/0005-libtls-Fix-authentication-bypass-and-expired-pointer.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
@@ -1,3 +1,12 @@
+strongswan (5.9.8-4) unstable; urgency=medium
+
+  * d/patches: libtls-Fix-authentication-bypass-and-expired-pointer added.
+    Fix authentication bypass and use-after-free in libtls (CVE-2023-26463)
+  * d/control: replace lsb-base dependency by sysvinit-utils
+  * d/control: update standards version to 4.6.2
+
+ -- Yves-Alexis Perez <corsac at debian.org>  Sun, 26 Feb 2023 09:40:09 +0100
+
 strongswan (5.9.8-3) unstable; urgency=medium
 
   * d/tests: also drop _copyright test since the util is gone as well


=====================================
debian/control
=====================================
@@ -3,7 +3,7 @@ Section: net
 Priority: optional
 Maintainer: strongSwan Maintainers <pkg-swan-devel at lists.alioth.debian.org>
 Uploaders: Yves-Alexis Perez <corsac at debian.org>
-Standards-Version: 4.6.0
+Standards-Version: 4.6.2
 Vcs-Browser: https://salsa.debian.org/debian/strongswan
 Vcs-Git: https://salsa.debian.org/debian/strongswan.git
 Build-Depends: bison,
@@ -209,7 +209,7 @@ Architecture: any
 Pre-Depends: ${misc:Pre-Depends}
 Depends: adduser,
          libstrongswan (= ${binary:Version}),
-         lsb-base (>= 3.0-6),
+         sysvinit-utils (>= 3.05-3),
          ${misc:Depends},
          ${shlibs:Depends}
 Recommends: strongswan-charon


=====================================
debian/patches/0005-libtls-Fix-authentication-bypass-and-expired-pointer.patch
=====================================
@@ -0,0 +1,43 @@
+From: Tobias Brunner <tobias at strongswan.org>
+Date: Fri, 17 Feb 2023 15:07:20 +0100
+Subject: libtls: Fix authentication bypass and expired pointer dereference
+
+`public` is returned, but previously only if a trusted key was found.
+We obviously don't want to return untrusted keys.  However, since the
+reference is released after determining the key type, the returned
+object also doesn't have the correct refcount.
+
+So when the returned reference is released after verifying the TLS
+signature, the public key object is actually destroyed.  The certificate
+object then points to an expired pointer, which is dereferenced once it
+itself is destroyed after the authentication is complete.  Depending on
+whether the pointer is valid (i.e. points to memory allocated to the
+process) and what was allocated there after the public key was freed,
+this could result in a segmentation fault or even code execution.
+
+Fixes: 63fd718915b5 ("libtls: call create_public_enumerator() with key_type")
+Fixes: CVE-2023-26463
+---
+ src/libtls/tls_server.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
+index c9c3009..573893f 100644
+--- a/src/libtls/tls_server.c
++++ b/src/libtls/tls_server.c
+@@ -183,11 +183,11 @@ public_key_t *tls_find_public_key(auth_cfg_t *peer_auth, identification_t *id)
+ 	cert = peer_auth->get(peer_auth, AUTH_HELPER_SUBJECT_CERT);
+ 	if (cert)
+ 	{
+-		public = cert->get_public_key(cert);
+-		if (public)
++		current = cert->get_public_key(cert);
++		if (current)
+ 		{
+-			key_type = public->get_type(public);
+-			public->destroy(public);
++			key_type = current->get_type(current);
++			current->destroy(current);
+ 		}
+ 		enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
+ 											key_type, id, peer_auth, TRUE);


=====================================
debian/patches/series
=====================================
@@ -2,3 +2,4 @@
 03_systemd-service.patch
 04_disable-libtls-tests.patch
 dont-load-kernel-libipsec-plugin-by-default.patch
+0005-libtls-Fix-authentication-bypass-and-expired-pointer.patch



View it on GitLab: https://salsa.debian.org/debian/strongswan/-/compare/101e0af80da038d302020c188330dd21f9d098e8...190b82e54e350050c3bec9a460f3f712a67983f9

-- 
View it on GitLab: https://salsa.debian.org/debian/strongswan/-/compare/101e0af80da038d302020c188330dd21f9d098e8...190b82e54e350050c3bec9a460f3f712a67983f9
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-swan-devel/attachments/20230302/f0d232ad/attachment-0001.htm>